ldapsearch

--hostname {address}

Address of the server to which the connection is established

--port {port}

TCP port of the server to which the connection is established. The standard port for non-secure LDAP, or LDAP to be secured with StartTLS, is 389, and the standard port for secure LDAPS is 636. Many deployments use alternate ports, especially non-privileged ports above 1024.

--useSSL

The tool establishes an initially insecure LDAP connection, which is secured later with the StartTLS extended operation.

--trustStorePath {path}

Path to the trust store that is used when determining whether to trust the certificate chain that the server presents during TLS negotiation. If neither this argument nor the --trustAll argument is provided, the tool prompts you interactively whether to trust server certificates that are not signed by an issuer in the Java virtual machine’s (JVM’s) default trust store.

--trustStoreFormat {format}

Format for the trust store, which is typically JKS or PKCS12.

--trustStorePassword {password}

Password that is required to access the contents of the trust store.

--trustStorePasswordFile {path}

Path to the file that contains the password that is required to access the contents of the trust store.

--trustAll

The tool blindly trusts all TLS certificate chains that are presented to it. Although this argument can prove useful for troubleshooting purposes, it is not recommended for general use.

--keyStorePath {path}

Path to the key store to use if a client certificate chain is presented to the server.

--keyStoreFormat {format}

Format for the key store, which is typically JKS or PKCS12.

--keyStorePassword {password}

Password to access the key store.

--keyStorePasswordFile {path}

Path to the file that contains the password necessary to access the key store.

--certNickname {alias}

Alias of the private key entry in the key store. Use when obtaining the certificate chain to present to the server.

--useSASLExternal

The client authenticates with the EXTERNAL SASL mechanism, which typically identifies the client using the certificate chain that is presented during TLS negotiation.

--enableSSLDebugging

The tool activates the low-level TLS-debugging feature that the JVM provides.