[Web] Improve clarity of LDAP SSL/TLS settings

[FreddleSpl0it]

Contribution Guidelines

• I've read the contribution guidelines and wholeheartedly agree them

What does this PR include?

Short Description

This PR adds Tooltips for the LDAP SSL/TLS options.

Affected Containers

• PHP-FPM

[patschi]

In regards to: TLS is recommended over SSL. I'm not so sure about that. There are pages [1][2][3] which suggest and state seeing SSL (via TCP/636) as deprecated and prefer StartTLS approach.

But StartTLS has the main security-wise disadvantage, that it starts with plain-text communication before upgrading to TLS, and can also be forced to downgrade. Effectively reducing security. So I also found a discussion of OpenLDAP where they are looking to get the dedicated port (SSL) recommended [4][5].

So I'm not sure what is true now. I'd change it to more neutral and leave this up to the customer - the dedicated SSL port seems however more secure, as there is now downgrade possibility which favors security.

Also: I think the "SSL" option does not necessarily refer to the old SSL transport encryption and also includes TLS. It's just some 'legacy' naming.

---

[1] https://www.openldap.org/faq/data/cache/605.html
[2] https://ldaprecord.com/docs/core/v3/configuration/#ssl--tls:~:text=in%20Active%20Directory.-,TLS%20is%20recommended%20over,SASL,-This%20boolean%20option
[3] https://kb.symas.com/configuration/overview-of-tls-and-ldaps
[4] https://unix.stackexchange.com/questions/607560/why-is-ldap-with-starttls-preferred-over-ldaps
[5] https://lists.openldap.org/hyperkitty/list/[email protected]/thread/IXEZAGCOTL5CTSOFNFDE65LURQET6ZZV/#LZ4N3JHGKZVDXRIXNRAM4SHZ44B5U4BP

[FreddleSpl0it]

@patschi i removed the TLS is recommendations from the tooltips