What it's for
Port 636 is LDAPS — LDAP wrapped in implicit TLS encryption from the start of the connection. It provides the same directory lookup and authentication functionality as plain LDAP on port 389, but ensures credentials and directory data are encrypted in transit, which matters given how often LDAP carries actual user passwords during authentication flows.
Protocol basics
Functionally, LDAPS on port 636 speaks the same LDAP protocol as port 389 — the difference is entirely in the transport layer, with TLS negotiated immediately as part of the connection rather than upgraded mid-session via StartTLS (which port 389 supports as an alternative encryption path). Because the TLS handshake happens before any LDAP traffic, there's no risk of a downgrade attack stripping encryption the way there theoretically can be with an optional StartTLS upgrade — this is why many security-conscious deployments prefer 636 outright over relying on StartTLS on 389.