I am just wondering why is LDAP with STARTTLS is a more preferred industry standard over LDAPS. LDAPS start the communication with encrypted information to begin with whereas STARTTLS only upgrades to an encrypted connection once the authentication is successful.
STARTTLS only upgrades to an encrypted connection once the authentication is successful
Are you sure? With SMTP, TLS is started first and authentication is performed over the encrypted connection. This suggests LDAP works the same way:
This value activates STARTTLS encryption for any server-side traffic that requires STARTTLS encryption. In this case, the BIG-IP system activates STARTTLS when a successful connection is made.
In general regarding STARTTLS:
I am just wondering why is LDAP with STARTTLS is a more preferred industry standard over LDAPS.
Some reasons to use STARTTLS over always using an encrypted connection:
- Clients that do not support STARTTLS can still connect and receive a protocol-valid error, which they can show to the user. Clients that don't support encryption will not be able to connect to a LDAPS server at all. This means when TLS is required, STARTTLS provides better diagnostics.
- STARTTLS could potentially also provide better diagnostics when TLS is required and the client supports it, but the handshake fails for whatever reason.
- STARTTLS can be optional. When it is, one port services both encrypted and plain text clients. With LDAPS the client must get the port right or connection fails.