The “signing” thing is so Microsoft doesn’t have to “fix” their own stuff. Their own internals make heavy use of 389 and they didn’t want to deal with the complexity of SSL and certs. This is pretty much SOP and how they deal with their use of clear text protocols in general (tons of this stuff in the MS world, not just 389 LDAP). 636 LDAPS, despite false information out there, is secure and is the solution for non-Microsoft things to continue to use LDAP binds for enumeration/authentication and does not require signing. Until Microsoft obliterates Active Directory… which, btw, is sort of “in the works”. Then everyone will cry as this ends pretty much what is “known” and “expected” by most in the Windows world. Microsoft has “answers”, but you won’t like them.
And yes, most will use an internal CA and push trusts. That’s what we do. Does still mean certificate management becomes a bigger deal (they do expire).
World+dog believes everyone’s CA is compromised (FUD message for monetary gain), so the “message” is that all (emphasis) SSL is compromised everyone (that’s the FUD message that certain players want out there). SSL certs is a big business. Running your own CA with a long expiration and long expiring certs and learning how to manage that removes a lot of money from “important people”. That is… this is political/greed focused. And, of course, as the only valid answer, the idea is to push you to the Microsoft (only) cloud and what they’ve coined “modern auth”, but the good (according to Microsoft) “modern auth” is the one that requires you to pretty much pay Microsoft in some way.
More (just because)
The idea from Microsoft is to get rid of all passwords. However, they are not ready for this as long standing protocols, little things like file/print sharing, still rely on NTLMv2 and things like passwords (there’s more, just an example, rdp can be another example). In the past (today), passwords allowed non-domain-members to achieve access. Even if they used a domain account, it just wouldn’t be ticketed (kerberos). There are bridges they are trying to cross today to create kerberos-cloud, which ensures a level of trust first (that is, you must love Microsoft and pay) and then “whatever” you do as a foreigner can get some type of “ticket” for trust (leveraging the fact that we all love Microsoft and are paying somehow for cloud services… btw, yes, very very very Internet tied).
It’s not like the non-Microsoft world doesn’t have “things” that are passwordless, it’s just that Microsoft doesn’t want (typical) to leverage any of that in their proprietary solution (that is, a way to make big money).
Microsoft lives in the “big corporation” world where each company wants to foster big money spends off one another. But, somebody has to be king, and Microsoft wants to be “that king”. Btw, all of this, is working (they are well on their way).
More than you wanted to know. Get ready for a very very very high latency world that is completely dependent on the Internet and the Microsoft cloud.