Hello,
No tlsVerifyMode=None should be enough.
Could you show me your SOGoUserSources block in your sogo.conf ? (mind the password in it)

Could you also add LDAPDebugEnabled = YES; and try (without your cert ibeing trusted) and show me the log ?

SOGoUserSources = (
{
type = ldap;
CNFieldName = displayName;
UIDFieldName = cn;
IDFieldName = cn; // first field of the DN for direct binds
bindFields = (cn, mail); // array of fields to use for indirect binds
baseDN = "dc=company,dc=com";
bindDN = "cn=sogo,ou=systemaccounts,dc=company,dc=com";
bindPassword = "REDACTED;
canAuthenticate = YES;
displayName = "Address Book";
hostname = ldaps://hostname.com:636?tlsVerifyMode=None;
/ hostname = ldap://hostname.com:389; /
id = company;
isAddressBook = YES;
},

I was seeing the following error:

2026-10-14 20:00:02.601 sogod[217599:217599] File NSDictionary.m: 671. In -[NSDictionary initWithContentsOfFile:] Contents of file '/etc/sogo/sogo.conf' does not contain a dictionary
<0x0x55fed9b723f0[SOGoStartupLogger]> Cannot read configuration from '/etc/sogo/sogo.conf'. Aborting

The only change besides a working config and this is adding "?tlsVerifyMode=None"

The above post filtered out the asterisks but the second hostname in the block is commented out

Adding quotes seems to fix it so guessing it didn't like the special characters without quotes.

hostname = "ldaps://hostname.com:636?tlsVerifyMode=None";

For me, adding the quotes moved from:

REASON:operation bind failed: Can't contact LDAP server (0xFFFFFFFF)"

to

Using ldap_initialize for LDAP URL: ldaps://ldap.company.com:636&tlsVerifyMode=None
ERROR: ldap_initialize: Bad parameter to an ldap routine

My only diff to the config:

diff --git a/sogo/sogo.conf b/sogo/sogo.conf
index 2cac41c..532f342 100644
--- a/sogo/sogo.conf
+++ b/sogo/sogo.conf
@@ -62,7 +62,7 @@
         bindFields= (mail,uid);
         // bindPassword = secret;
         canAuthenticate = YES;
-        hostname = ldaps://ldap.company.com;
+        hostname = "ldaps://ldap.company.com:636&tlsVerifyMode=None";
         id = ldaplocalgroups;
         displayName = "Groups";
         isAddressBook = YES;
@@ -83,7 +83,7 @@
         // bindPassword = secret;
         bindFields= (mail,uid);
        canAuthenticate = YES;
-        hostname = ldaps://ldap.company.com;
+        hostname = "ldaps://ldap.company.com:636&tlsVerifyMode=None";
        bindAsCurrentUser = YES;
         userPasswordAlgorithm = ssha;
        id = ldaplocal;

You miss the ? to separate the uri from the query

ldaps://ldap.company.com:636?tlsVerifyMode=None

not

ldaps://ldap.company.com:636&tlsVerifyMode=None

Heh, I was about to reply with that, as I just found it myself. Sorry for the noise.

What is still an issue is the need for quotes, moreover when the announcement had an example without them.

I've updated the news -> https://www.sogo.nu/news/2026/sogo-v51212-released.html