Update deployments/services/authentication/Active Directory/Certificate Services.md

deployments/services/authentication/Active Directory/Certificate Services.md

@@ -613,3 +613,68 @@ Recommended operational tasks:
     - Harden CA servers; limit access to PKI admins.
     - Use BitLocker or HSM for key protection.
     - Monitor issuance and renewals with audit logs and scripts.
+
+## Export the LDAPS Certificate for Third-Party Applications
+
+Some applications do not automatically trust your internal PKI and require you to manually install the certificate used by your domain controllers for LDAPS.  In most cases, you should export the issuing CA certificates rather than the individual domain controller certificate.  Only export the domain controller certificate if the third-party application explicitly requires it.
+
+### Export the Root and Subordinate CA Certificates
+
+The Root CA and Subordinate CA certificates establish trust for every domain controller certificate issued by your PKI.
+
+From any domain-joined system:
+
+* Launch `certlm.msc`
+
+  * Navigate to "**Trusted Root Certification Authorities > Certificates**"
+
+    * Locate your Root CA certificate
+    * Right-click the certificate and select "**All Tasks > Export...**"
+
+      * Select "**No, do not export the private key**"
+      * Export the certificate as either:
+
+        * `DER encoded binary X.509 (.CER)`, or
+        * `Base-64 encoded X.509 (.CER)`
+  * Navigate to "**Intermediate Certification Authorities > Certificates**"
+
+    * Locate your Subordinate CA certificate
+    * Repeat the export process
+
+Import both certificates into the trusted certificate store required by the third-party application.
+
+### Export a Domain Controller Certificate
+
+If the application requires the LDAPS server certificate itself:
+
+* On the target domain controller, launch `certlm.msc`
+
+  * Navigate to "**Personal > Certificates**"
+
+    * Locate the certificate issued to the domain controller's FQDN that includes **Server Authentication** as an intended purpose
+    * Right-click the certificate and select "**All Tasks > Export...**"
+
+      * Select "**No, do not export the private key**"
+      * Export the certificate as either:
+
+        * `DER encoded binary X.509 (.CER)`, or
+        * `Base-64 encoded X.509 (.CER)`
+
+!!! warning "Do Not Export the Private Key"
+Third-party LDAPS clients require only the public certificate.  Do **not** export the certificate as a `.pfx` file or include the private key unless the vendor explicitly documents that requirement.
+
+### Validate the Exported Certificate
+
+Run the following command against the exported certificate:
+
+```powershell
+certutil -verify -urlfetch <EXPORTED_CERTIFICATE>.cer
+```
+
+Verify that:
+
+* The certificate chains back to your internal Root CA.
+* The certificate is currently valid.
+* The output does not contain `CRYPT_E_REVOCATION_OFFLINE`.
+
+If the application connects by hostname, ensure it uses the same FQDN that appears in the domain controller certificate.  Connecting by IP address will typically fail certificate validation unless the IP address is present in the certificate's Subject Alternative Name.