Port 636 provides LDAP over implicit TLS (ldaps://). Many applications such as Nextcloud LDAP, SSSD or mail servers prefer LDAPS because no StartTLS downgrade is possible. In Active Directory, 636 only works once the domain controller has a suitable certificate.
Like port 389: internal only, open just for the servers that query it, never to the internet.
Common errors: Can't contact LDAP server (-1) because the client doesn't trust the CA – set TLS_CACERT in /etc/ldap/ldap.conf – or a hostname mismatch because the client connects by IP.
Check
openssl s_client -connect ldap.example.com:636 -showcerts