LDAPS Not Working on a Domain Controller: A Read-First Certificate, LDAP Signing, and Event 2889 Triage

Helpdesk: "Since we added DC3 on Windows Server 2025 last week, the door-badge server's directory sync fails with 'Strong Authentication Required' whenever it lands on DC3. The firewall's LDAPS test a