Configure hudson.plugins.active_directory logger in the System logs to debug the Active Directory.

Go to JENKINS_URL/configureSecurity

Select Active directory in Security Realm 

Setup your AD configuration

Require TLS checkbox is activated by default.

Click on Test-Domain

The logger shows: Connecting to ldaps://mydlapserver

Uncheck the Require TLS checkbox.

Click on Test-Domain

The logger shows: Connecting to ldaps://mydlapserver

If you save the configuration, with Require TLS disabled, 
the correct TLS setting will be saved and Jenkins will use ldap://

If you back to JENKINS_URL/configureSecurity and click on 'Test-Domain', with 'Require TLS' still disabled, the test will be properly done with  ldap://
But if you enable Require TLS, and click on Test-Domain the test will incorrectly be performed with ldap:// instead of ldaps://