What uses port 636
LDAPS wraps the whole LDAP session in TLS, so passwords sent when applications bind to the directory are protected. Active Directory domain controllers serve LDAPS once they have a suitable certificate. Clients must trust the certificate and connect using a name that appears in it, or the connection fails.
Should port 636 be open to the internet?
Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.
Check what is listening on port 636
sudo ss -ltnp 'sport = :636'sudo lsof -nP -iTCP:636 -sTCP:LISTENGet-NetTCPConnection -LocalPort 636 -State Listen
netstat -ano | findstr :636No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.
Fix “address already in use” on port 636
Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:
sudo kill $(sudo lsof -t -iTCP:636 -sTCP:LISTEN)Stop-Process -Id (Get-NetTCPConnection -LocalPort 636 -State Listen).OwningProcessAllow port 636 from trusted networks only
The examples allow 636 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.
sudo ufw allow from 10.0.0.0/8 to any port 636 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 636 proto tcpsudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="636" protocol="tcp" accept'
sudo firewall-cmd --reloadNew-NetFirewallRule -DisplayName "LDAPS 636/TCP" -Direction Inbound -Protocol TCP -LocalPort 636 -Action Allow -RemoteAddress 10.0.0.0/8On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.
Test port 636 from another machine
nc -zv example.com 636Test-NetConnection example.com -Port 636Related ports
- Port 389 (LDAP): used by LDAP for directory lookups and authentication, including Active Directory.
- Port 88 (Kerberos): used by Kerberos authentication, including Active Directory logins.
- Port 3269 (Global Catalog over TLS): used by the Active Directory Global Catalog over TLS.
More network services ports
53 (DNS) , 67 (DHCP server) , 68 (DHCP client) , 123 (NTP) , 135 (Microsoft RPC) , 137 (NetBIOS Name Service) , 179 (BGP) , 853 (DNS over TLS) . See all ports in the port lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is port 636 used for?
Port 636 is used by LDAP over TLS (LDAPS) for encrypted directory access. LDAPS wraps the whole LDAP session in TLS, so passwords sent when applications bind to the directory are protected. Active Directory domain controllers serve LDAPS once they have a suitable certificate. Clients must trust the certificate and connect using a name that appears in it, or the connection fails.
Is it safe to open port 636?
Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.
How do I check if port 636 is open?
On the server, list listening sockets with "sudo ss -ltnp 'sport = :636'" on Linux or "sudo lsof -nP -i :636" on macOS. From another machine, run "nc -zv host 636" or, on Windows, "Test-NetConnection host -Port 636". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.