Well, the specific products we need to talk to FreeIPA support LDAPS (implicit SSL via port 636, rather than explicit via STARTTLS on port 389 - in fact at least some only support implicit), 389DS does support LDAPS (even if it is not a FreeIPA sanctioned mode), so as the saying goes if it's stupid and it works, it ain't stupid. :)

For server sign-on and so forth, SSSD and so on will do what they do normally - we aren't mangling any of the pre-defined DNS or other FreeIPA magic. This is just to provide a highly available and secure LDAP service for everything else that can't use the multiple SRV records or other means of assigning / detecting multiple LDAP servers (i.e. Jira, Confluence, Bitbucket ... ) 

On Thu, Aug 22, 2019 at 1:22 AM Alexander Bokovoy <abokovoy@redhat.com> wrote:
On ke, 21 elo 2019, Jonathan Vaughn via FreeIPA-users wrote:
>Ah, I didn't realize I could do SSL termination in TCP mode. That would
>certainly solve our LDAP HA problem with less effort! I'll try that.
Note that FreeIPA doesn't really use LDAPS (and there is no such thing
as LDAPS in protocol specs, it was never formalized). FreeIPA uses
startTLS in LDAP -- at least SSSD will actively rely on it. Also Windows
doesn't allow use of LDAPS+GSSAPI.

>
>On Wed, Aug 21, 2019 at 8:27 PM Daniel Oetken via FreeIPA-users <
>freeipa-users@lists.fedorahosted.org> wrote:
>
>> Why doesn’t terminating SSL on the proxy work with LDAPS? Because it
>> should, and says so too here:
>> https://www.mail-archive.com/haproxy@formilux.org/msg21657.html
>>
>>
>> Though, I’m looking into the same thing to add SAN to the server
>> certificate and wondering about similar questions. When you look at
>> “ipa-getcert list” you should see the current certificates already,
>> including their settings, so I was thinking to just stop tracking those old
>> ones and create new ones like you did, except with the exact same options
>> as the old ones (+ SAN). But yeah, I’m not sure if there is anything else
>> involved, or if there is a better way. I only started using freeipa
>> recently.
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
>> Fedora Code of Conduct:
>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
>>

>_______________________________________________
>FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
>To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
>Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org


--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland