Can APM ActiveDirectory AAA server use port 636, or StartTLS on 389?

I've noticed that when I set up management/administration of an F5, and I can allow remote active directory users to log in, and I can select whether they use port 389 (cleartext LDAP), port 636 (LDA...