How to Configure Secure LDAP (LDAPS) Authentication with Windows Server 2025 Active Directory on Zyxel Firewalls (uOS)

The USG FLEX H Series provides two different methods for integrating with a directory service for user authentication.

• LDAP/LDAPS Server – A standard LDAP client that can authenticate users against Microsoft Active Directory as well as other LDAP-compatible directory services, such as OpenLDAP. The firewall authenticates users through LDAP or LDAPS queries and does not join the Active Directory domain.
• AD Server – A Zyxel feature designed specifically for Microsoft Active Directory. The firewall joins the Active Directory domain as a domain member (similar to a Windows computer) and communicates directly with the domain.

This article explains how to configure Secure LDAP (LDAPS) authentication on a USG FLEX H Series Firewall using Windows Server 2025 Active Directory.

Note: If you want the firewall to join the Active Directory domain and use the built-in Zyxel AD Server feature instead of LDAP/LDAPS authentication, please refer to the following article:

Note:  The LDAP server is not listed as an authentication option for IPSec VPN because it is not supported. Authentication options for different VPN types are as follows:

IKEv1 (L2TP VPN): Nebula Cloud Authentication, Active Directory (AD), RADIUS, and LDAP.
IKEv2 (IPSec VPN): Nebula Cloud Authentication, Active Directory (AD), and RADIUS.

Prerequisites

Before starting, ensure that the following requirements are met:

• Zyxel Firewall running uOS 1.39 or later
• Windows Server 2025 with Active Directory Domain Services (AD DS) installed
• Active Directory Certificate Services (AD CS)
• DNS is correctly configured, allowing the firewall to resolve the AD domain and Domain Controller
• Network connectivity between the firewall and the Domain Controller
• A Domain Administrator account (or an account with sufficient permissions to join PC to the domain)
• Administrator access to both the firewall and the Windows Server

Why use LDAPS?

Note: Although standard LDAP (TCP 389) is still supported by many environments, LDAPS is recommended for production deployments because it encrypts all communication between the firewall and the Active Directory server.

Step 1 - Install Active Directory Certificate Services (AD CS)

Before configuring LDAPS, the Domain Controller must have a valid certificate that supports Server Authentication. This certificate is issued by Active Directory Certificate Services (AD CS).

In this example, the Domain Controller also hosts the Certification Authority.

Open the Add Roles and Features Wizard

1. Open Server Manager.
2. Click Manage.
3. Select Add Roles and Features.

Step 2 - Configure Active Directory Certificate Services

After the installation finishes, click:

Configure Active Directory Certificate Services on the destination server

Enterprise CA integrates with Active Directory and is recommended for domain environments. It supports automatic certificate enrollment and is required for most Active Directory certificate deployments, including LDAPS.

Standalone CA is intended for isolated or offline deployments and does not integrate with Active Directory.

Note: This example uses an Enterprise Root CA with a new private key to simplify the deployment. These settings are recommended for a new CA installation and are sufficient for LDAPS authentication in most lab and SMB environments.

Cryptography

Leave the default settings:

• Cryptographic Provider: RSA#Microsoft Software Key Storage Provider
• Key Length: 2048 bits
• Hash Algorithm: SHA256

CA Name

Specify a descriptive name for the Certification Authority or keep the automatically generated value.

Example:

ZY-Root-CA

Note: The default cryptographic settings are recommended for most deployments. The CA name identifies the Certification Authority and will appear in all certificates issued by this CA.

Step 3- Verify the Certification Authority

After completing the AD CS configuration, verify that the Certification Authority has been successfully installed and is operational.

1. Open Server Manager.
2. Click Tools.
3. Select Certification Authority.
4. Verify that the Certification Authority is listed and its status is displayed without errors.

Note: A green status icon next to the Certification Authority indicates that the service is running correctly and is ready to issue certificates.

Verify the Domain Controller Certificate 

1. Open Run, type certlm.msc, and press Enter.
2. Navigate to Certificates (Local Computer) → Personal → Certificates.
3. Verify that the Domain Controller certificate is present and includes the Server Authentication enhanced key usage.

Note: The Domain Controller must have a valid Server Authentication certificate to accept LDAPS connections over TCP port 636.

Verify LDAPS Connectivity

Verify that the Domain Controller is accepting secure LDAP connections on TCP port 636.

Run the following command in PowerShell:

Test-NetConnection localhost -Port 636

Verify that TcpTestSucceeded is True.

Note: If the test fails, verify that the Domain Controller has a valid Server Authentication certificate and that the Active Directory Domain Services service has been restarted after the certificate was issued.

Step 4 - Export the Root CA Certificate

1. Open Certification Authority.
2. Right-click the Certification Authority and select Properties.
3. On the General tab, click View Certificate.
4. Go to the Details tab and click Copy to File....

Note: Export only the Root CA certificate. Do not export the private key.

1. Select Base-64 encoded X.509 (.CER) and click Next.
2. Specify a file name and click Finish.

Step 5 - Import the Root CA Certificate into the Firewall

• Log in to the USG FLEX H web interface. 
• Navigate to System → Certificate → Trusted Certificates. 
• Click Import. Enter a Name (for example, ZY-Root-CA). 
• Select the exported ZY-Root-CA.cer file. 
• Click OK to import the certificate.

Note: The imported CA certificate will be used to verify the identity of the LDAPS server during the TLS handshake.

Step 6 – Configure the LDAPS Server on Firewall H Series

Find the Distinguished Name (DN)

To obtain the Distinguished Name (DN) of an Active Directory user:

1. Open Active Directory Users and Computers.
2. Locate and right-click the user account, then select Properties.

3. Open the Attribute Editor tab.

   Note: If the Attribute Editor tab is not visible, enable Advanced Features from the View menu.

4. Locate the distinguishedName attribute and click View.
5. Copy the displayed value.

Configure the LDAP server using your Active Directory settings.

• Navigate to User & Authentication → User Authentication → AAA Server. 
• In the LDAP Server section, click Add. 

Note: The Bind DN must be entered using the user's full Distinguished Name (DN), for example:

CN=ldap1,OU=Users,OU=IT,OU=DE_Campus,DC=zy,DC=local

Step 7 – Validate the LDAP Server Configuration

To verify that the LDAP server is configured correctly and that the firewall can communicate with Active Directory, perform a configuration validation.

1. Navigate to User & Authentication > User/Group > User.
2. Click Add.
3. Configure the following settings:
   • User Type – External Group User
   • Authentication Server – Select the LDAP server created in the previous step.
   • Group Identifier – Select an existing Active Directory group.
4. Under Configuration Validation, enter the username of an existing Active Directory user who is a member of the selected group.
5. Click Test.

If the validation is successful, the firewall displays a confirmation message indicating that the user belongs to the selected Active Directory group. The Returned User Attributes section also displays the LDAP attributes retrieved from the directory server.

This confirms that the firewall can successfully communicate with the LDAP server and query Active Directory users and group membership.

Step 8 – Verify LDAP Authentication with SSL VPN

To verify that LDAP authentication is working correctly, configure the SSL VPN server to use the LDAP server and authenticate with an Active Directory user.

1. Navigate to VPN > SSL VPN.
2. Under the Authentication section, select the configured LDAP Server as the Primary Server.
3. Click Download to download the SSL VPN client configuration.
4. Import the configuration into the SecuExtender VPN Client and connect to the VPN.
5. When prompted, enter the credentials of an Active Directory user and click OK.

If the configuration is correct, the firewall authenticates the user against the LDAP server and establishes the SSL VPN connection successfully.