59bf74760c
Self-signed cert (SAN IP 10.100.0.35), public cert checked in, key host-only. Deployed on 10.100.0.35: TLS chain verifies with the cert and fails without it; raw LDAPS simple bind returns 0 for a good password and 49 for a bad one; plain :3893 bind unchanged. README: thumbprint, client config, rotation; also fixes the user-bind DN example (GLAuth puts users under their primary group OU). Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV