I know this is some 3 years late, but I have been fighting our 2162DS-2 over the past two days and can add the following:

I used my local machines copy of the domain certificate for the device. Uploaded it and it was fine, however i was still getting no end of grief from the device. It would just sit at the login page for an age and not log in and eventually time out. It would do this about 90% of the time (the remaining 10% of the time it would work, albeit rather slowly).

The breakthrough came when I hooked up the serial cable and used option 8 for the LDAP monitoring. It turns out that the LDAP redundancy 'feature' on the 2161DS-2's are actually their biggest weakness, as ours queries the AD for a list of Domain controllers, and then tries to make an LDAP connection to one chosen apparently at random. This is a huge problem, as well over 80% of our DC's are located overseas on 'bad' lines with quite a bit of latency. The way I solved the problem was to write an ACL on the switch that barred our 2161DS-2 from talking to the IP addresses of any domain controllers other than the one in our local office (the other alternative is to remove the default gateway, thus rendering the device inaccessible from outside its local office).

HTH.

olobley,

Can you give a little more information on the ACL that you wrote?  I would like to give that a try.  I can't remove the gateway as I have different subnets in use.

Thanks,