I\'m rewording my question so hopefully I can get a better response. I asked a similar question on serverfault here, and think that a proper and valid TLS server i
LDAP uses an extended operation to initiate installation of the TLS layer. See also section 4.14 in the RFC.