sssd authentication to AD over port 636

I'm trying to get sssd to play nice with Active Directory on port 636. It works beautifully using 389, but not 636. I import the base64 CA root certificate to /etc/ssl/certs directory, but I can't seem to figure out the exact formula. I've tried the following to no success; ldap_uri = ldaps://ldap.FQDN, or ldap_id_use_start_tls = True.

Any help would be appreciated.