Any chance this can make it into 2.4?
Having this on the LDAP Settings screens would be safer than a file that could be overwritten or skipped at patch time.
Based on some testing, I think the host & port fields should be replaced with an "LDAP URI" field and a checkbox for StartTLS.
There are 3 cases:
- ldap://hostname:port without StartTLS: (Auth in clear text)
- ldap://hostname:port with StartTLS
- ldaps://hostname:port without StartTLS (it doesn't apply)
php_ldap seems to ignore the separate port option when the host field is an URI. Cases 1 & 2 use the standard ldap port 389 or 3268 for AD global catalog. Case 3 uses port 636 or 3269.
For cases 2 & 3, certificate configuration is needed in openldap or settings to ignore certificate validation.
For "Port" we documented that it's ignored if specified in URI
https://www.zabbix.com/documentation/4.2/manual/web_interface/frontend_sections/administration/authentication
LDAP, or SMTP, or IMAP, or POP3, etc all work in similiar ways
- For SMTP zabbix allows to use the 3 ways (SMTP | SMTPS | SMTP+startTLS)
- For LDAP, zabbix only alllows to use 2 ways (LDAP | LDAPS), so LDAP+StartTLS is currently missing.
Since the base framework already is capable of accepting LDAP+StartTLS connections (as referenced in the original feature request - and here https://github.com/zabbix/zabbix/blob/master/frontends/php/include/classes/ldap/CLdap.php#L58) and zabbix already have a similiar option for SMTP ion Email Media Type (https://www.zabbix.com/documentation/4.2/pt/manual/config/notifications/media/email), seems what is needed is to add that new option to the interface, for instance, reusing part of what is done with SMTP (Email Media Type) and then using it when logging in with LDAP.
Well... reported more than 7 years ago for Version 2.0. Implementation TRIVIAL by adding a checkbox on the GUI as even the feature is supported in the library and can be enabled by changing a boolean variable in PHP we still have to edit the PHP file on each release.
I am hoping for implementation "soon", but not holding my breath. 
At least there is a workaround available.
This will be quite an issue if I find editing the CLdap.php file does not work.
I am installing Zabbix 5.0.3 on CentOS 8.2.
Note: Red Hat have removed/disabled SSL from the code.
At the moment when I try to configure ldaps:636 it fails.
Next week I will check if our AD server can be configured do LDAPS over TLS.
But I'm not holding my breath.
Support of LDAP+startTLS will be implemented as part of ZBXNEXT-2289.