An authentication error has occurred. The function requested is not supported.

Thanks for your reply. My guess right now (hope to test further tomorrow) is that even though my DCs have valid (purchased!) certs and allow LDAPS connections (which was to support our RSA Authentication Manager implementation) this cert doesn't have the 'domain controller' Microsofty tag, and therefore won't work for my smartcard work. Now I'm sure if I install a second, self-generated cert it will conflict with the purchased one.