AD LDS Stand Alone SSL gives error 81 (x51) when trying to connect with LDP.exe 3.0

Question

I  have a stand alone instance of ad lds on win server 2008 R2.  Using ldp.exe 3.0 I CAN do a NON-ssl connection and eventually a bind using servername or the fqdn which is the servername followed by a period (i.e servername.) or using the
IP address.  Note that the server is in a workgroup (not a domain).
However, when specifying the ssl port, ssl checkbox and any of the following servers in LDP.exe:
servername
servername. (note the trailing period)
ip addr
I get:
ld = ldap_sslinit("SRV9.", 50001, 1);
Error 0 = ldap_set_option(hLdap, LDAP_OPT_PROTOCOL_VERSION, 3);
Error 81 = ldap_connect(hLdap, NULL);
Server error: <empty>
Error <0x51>: Fail to connect to SRV9..
For SSL I expected the IP addr to fail because it has to be the FQDN. I expected the servername + period to work because it has on similar ad lds instances in the past.
I verified that the port is correct using dsdbutil.  I have also tried changing the port using dsdbutil.  Could this mess anything up if I specify that port in ldp.exe?
I have used the mmc certificate snap in to validate the certification path.  The rootCA and subCAs are valid and work on other websites.
Under the details tab I have validated:
Issuer
Valid dates
Subject  is SRV9
the template is WebServer
Server Authentication (1.3.6.1.5.5.7.3.1)
I have put the server cert in both the machine and service (for my ad lds instance) under the Personal store.  I also have put the two "parent" CA certs in the Trusted Root Cert stores for both the service and the machine.
Additionally, here is some partial output from netstat -ano on the ADLDS machine:
Active Connections
  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:50000          0.0.0.0:0              LISTENING       1256
  TCP    0.0.0.0:50001          0.0.0.0:0              LISTENING       1256
  TCP    [::]:50000             [::]:0                 LISTENING      
1256
  TCP    [::]:50001             [::]:0                 LISTENING      
1256
  UDP    10.200.41.75:40000     *:*                                   
1280
  UDP    10.200.41.75:50000     *:*                                   
1256
  UDP    127.0.0.1:59087        *:*                                   
1256
  UDP    127.0.0.1:59088        *:*                                   
1280
  UDP    127.0.0.1:59097        *:*                                   
1300
  UDP    [2001:0:9d38:90d7:245d:2f39:f537:d6b4]:40000  *:*             1280
  UDP    [2001:0:9d38:90d7:245d:2f39:f537:d6b4]:50000  *:*             1256
  UDP    [fe80::245d:2f39:f537:d6b4%13]:40000  *:*                     1280
  UDP    [fe80::245d:2f39:f537:d6b4%13]:50000  *:*                     1256
  UDP    [fe80::bd46:2e7e:708c:1c3a%11]:40000  *:*                     1280
  UDP    [fe80::bd46:2e7e:708c:1c3a%11]:50000  *:*                     1256
Also Taskman reveals:
PID
1256   dsamain.exe   ADLDS
1280   dsamain.exe   ADLDS (another instance that I am not using)
1300   AD Webservices
MY pid is 1256.  Port 50000 is non-ssl, 50001 is SSL.  I have no idea what port 59087 (attached to my pid) is for.
Thanks!
leo

Answer 1

Lee you rock!  Thanks!!
My problem was the missing read permission.  I modified the instructions a bit from your link for Windows Server 2008 R2 for the permission issue:
To grant the Read permission on the server authentication certificate to the Network service account
First go into control panel > Folder Options and turn on view hidden files.
Navigate to the following default directory where the installed or imported certificates are stored:
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
Right-click the appropriate server authentication certificate, and then click
Properties.  I see a strange filename convention.  I just sorted the files by date and picked the latest one.  Not sure how else to do it. Can someone please tell me the file naming convention of these files in MachineKeys?
On the Security tab, click Edit.
In the Permissions dialog box, click Add.
In the Select Users, Computers, or Groups dialog box, type
Network Service, and then click OK.
Turn off view hidden files in control panel Folder Options.
leo