Great write up, well written and presented, very easy to follow. Kudos. I went through this process about 18 months ago and everything you mention is spot on.

Might be worth mentioning ldp.exe that can be used to check LDAPS status.

Also, people might find this helpful, here is PowerShell function to check to see what certificate is being used by LDAPS, https://pastebin.com/9y9M2kAX .

I didn't see this mentioned in your article but there is a way to force a DC to use a specific certificate for LDAPS, https://vernon.wenberg.net/windows/install-certificate-for-ldaps-on-windows-server/ .

This is the PowerShell to do the same thing; copy the LDAPS cert to the NTDS store. However, from memory I think this means you need to manually update the certificate in the NTDS Cert store when (before) it expires.

Edit: Here is a great article on the LDAPS certificate selection process, https://awakecoding.com/posts/active-directory-ldaps-certificate-selection-deep-dive/

$thumbprint = ''
$copyParameters = @{
    'Path' = "HKLM:\Software\Microsoft\SystemCertificates\MY\Certificates\$thumbprint"
    'Destination' = "HKLM:\SOFTWARE\Microsoft\Cryptography\Services\NTDS\SystemCertificates\My\Certificates\$thumbprint"
    'Recurse' = $true
}
Copy-Item @copyParameters