Remote User Admin Authentication using encrypted Active Directory lookup

So I'm able to authenticate and authorize remote users against our domain controller. In fact its working over port 389 and 636. But I don't understand why I'm being asked for client cert and key for ssl? What cert and key is it asking for? The machine cert/key for my domain controller or the self-signed switch cert? It was my understanding that the server is responsible for encryption. I could understand the certificate ca being necessary to run the chain of the server, but after that, I'm not clear and haven't been able to gather the info in docs. Can anybody shed light on this for me?

Thanks!

Ward