[Samba] AD-level Certificate Authorities with samba?

[Michael Tokarev]

Hi!

What's the way to have a domain-based certificate authority so that
various TLS services can be enabled within a domain, including
LDAPS and other similar services?

The whole CA thing is already complex enough, microsoft has tools to
do all this on their domain management collection (Active Directory
Certificate Services).  What's the way to do all this in/with samba-
based AD?

Thanks,

/mjt