That excuse sounds like you don't understand how TLS works. It's not Active Directory's fault that you aren't validating its certificate. Active Directory (unfortunately) often provides its own CA, feeding that CA's chain to your (ldap library's) SSL store will enable you to validate the cert.