Provisioning to Active Directory: Failed to set password without LDAPS (SSL required?)

When provisioning to Active Directory, the LDAP connection on port 389 without SSL works (bind and read OK), but enabling the connectionSecurity=ssl parameter causes a denied connection. Without SSL, the creation of the accounts fails with the error PASSWORD_RESTRICTION/WILL_NOT_PERFORM when setting the password.

Does the AD connector require a secure connection (LDAPS/SSL) to set the password, and is an AD server-side certificate required to allow this to happen?