I've added code to -lldap to provide SASL/EXTERNAL(TLS) support. However, I don't have environment setup which I can easily use to test this code. Would appreciate it if someone could test: ldapsearch -ZZ -Y EXTERNAL .... your environment, of course, needs to support mutual TLS authentication. Thanks, Kurt