I am configuring an MQ Queue Manager (v9.3, on z/Linux) to authenticate using LDAP (Microsoft AD) for the first time and so far, I had no luck.
The AD server I need to connect to does not accept unsecure connections, so I need to connect using TLS, and I could not pass through the very first step: bind to the AD

What I tried:

At runmqsc:

DEFINE AUTHINFO(LDAP.MSAD) +
AUTHTYPE(IDPWLDAP) +
ADOPTCTX(YES) +
DESCR('LDAP Connector to MSAD' ) +
CONNAME('msad.acme.com(636)') +
CHCKCLNT(OPTIONAL) +
CHCKLOCL(OPTIONAL) +                   
CLASSGRP('group') +
CLASSUSR('user') +                      
FAILDLAY(1) +
FINDGRP('member') +
BASEDNG('DC=msad,DC=acme,DC=com') +
BASEDNU('DC=msad,DC=acme,DC=com') +
LDAPUSER('CN=mybind,OU=ServiceAccounts,DC=msad,DC=acme,DC=com') +
LDAPPWD('my_supersecret_passw0rd') +
SHORTUSR('sAMAccountName') +              
GRPFIELD('cn') +
USRFIELD('sAMAccountName') +             
AUTHORMD(SEARCHUSR) +
NESTGRP(NO) +
SECCOMM(YES) +
REPLACE

ALT QMGR CONNAUTH(LDAP.MSAD)

Setup the key.kdb

# Created key.kdb
  runmqakm -keydb -create -db key.kdb -pw passw0rd -type cms -stash
  
# Converted my CA Root cert, from PEM to DER format
  openssl x509 -in ./ca_root.pem -outform der -out ./ca_root.der
  
# Added CA Root to key.kdb
  runmqakm -cert -add -db key.kdb -stashed -label "ACME Internal Root CA" -file ./ca_root.der -format ascii
  
# Confirmed that the cert was imported
  runmqakm -cert -list -db key.kdb -stashed

And finally…

echo "REFRESH SECURITY" | runmqsc

I am sure that the bind id/password, as well as the root certificate, are good, as they are being used on WAS in the same server, and I can use them to run ldapsearch however, the message that I get printed on QM AMQERR01.LOG clearly shows that the bind to AD was unsuccessful

----- amqzfula.c : 3451 -------------------------------------------------------
09/04/2024 01:46:28 PM - Process(4100598.22) User(mqm) Program(amqzlaa0)
                    Host(myserver) Installation(Installation1)
                    VRMF(9.3.0.17) QMgr(MYQM)
                    Time(2024-09-04T20:46:28.479Z)
                    ArithInsert1(81)
                    CommentInsert1(ldap_simple_bind)
                    CommentInsert2(Can't contact LDAP server)
                    CommentInsert3(CN=mybind,OU=ServiceAccounts,DC=msad,DC=acme,DC=com )

AMQ5530E: Error from LDAP authentication and authorization service

EXPLANATION:
The LDAP authentication and authorization service has failed. The
'ldap_simple_bind' call returned error 81 : 'Can't contact LDAP server'.  The
context string is
'CN=mybind,OU=ServiceAccounts,DC=msad,DC=acme,DC=com
'. Additional code is 0.
ACTION:
Correct the LDAP configuration. Look at the LDAP server logs for additional
error information.
----- amqzfula.c : 3451 -------------------------------------------------------

Unfortunately, I don’t have access to the AD server log.

Clearly, I am missing some basic step at the very beginning, but I can’t identify it! Can someone help, please?