I wrote:
- ldapsearch -x -ZZ -h "ldap.domain.com" ...
This uses the LDAP protocol (on port 389), and -ZZ tells the client to use the StartTLS LDAP
Er, the StartTLS LDAP _operation_.
This switches to the TLS protocol and then resumes LDAP "inside" that protocol.