help with changing from LDAP to LDAPS - LDAPS is failing

[boostedvq35de]

my current ldap_config.py uses TCP 389 and authenticates my users fine.
however, when I try to change AUTH_LDAP_SERVER_URI to use port 636, then authentication begins to fail.
reverting to 389 works...

is there anything I'm missing:

! Working condition, TCP 389

import ldap

# Server URI
## If you are using secure ldap, of course, use ldaps
AUTH_LDAP_SERVER_URI = "ldap://ldap-server-hostname:389"
#AUTH_LDAP_SERVER_URI = "ldap://ldap-server-hostname:636"

# The following may be needed if you are binding to Active Directory.
AUTH_LDAP_CONNECTION_OPTIONS = {
   ldap.OPT_REFERRALS: 0
#   ldap.OPT_X_TLS_CACERTDIR: '/etc/ssl/certs',
#   ldap.OPT_X_TLS_REQUIRE_CERT: ldap.OPT_X_TLS_ALLOW,
#   ldap.OPT_X_TLS_NEWCTX: 0
}
...

! Failing condition, TCP 636

import ldap

# Server URI
## If you are using secure ldap, of course, use ldaps
#AUTH_LDAP_SERVER_URI = "ldap://ldap-server-hostname:389"
AUTH_LDAP_SERVER_URI = "ldap://ldap-server-hostname:636"

# The following may be needed if you are binding to Active Directory.
AUTH_LDAP_CONNECTION_OPTIONS = {
#   ldap.OPT_REFERRALS: 0
   ldap.OPT_X_TLS_CACERTDIR: '/etc/ssl/certs',
   ldap.OPT_X_TLS_REQUIRE_CERT: ldap.OPT_X_TLS_ALLOW,
   ldap.OPT_X_TLS_NEWCTX: 0
}
...

[candlerb]

I think it should be ldaps:// not ldap:// for port 636.

Then either your LDAP server will need a valid certificate (e.g. from Letsencrypt) or you'll need to make the CA cert which signed it available to the LDAP library.

[boostedvq35de]

I tried

1. changing to ldaps://
2. CA cert and its Sub-CAs already added to the trusted cert list...
   but no improvement... is there any additional debugging to enable or logs that would help further identify the issue?