diff --git a/config.php b/config.php
index 133f679..0dcc16f 100644
--- a/config.php
+++ b/config.php
@@ -9,7 +9,16 @@ define('PLUGIN_PASSWD_LDAP', false);
 define('PLUGIN_PASSWD_LDAP_BASEDN', 'dc=example,dc=com');
 
 /** URI to access LDAP server **/
-define('PLUGIN_PASSWD_LDAP_URI', 'localhost');
+define('PLUGIN_PASSWD_LDAP_URI', 'ldap://localhost');
+
+/** Use TLS to access LDAP server **/
+define('PLUGIN_PASSWD_LDAP_USE_TLS', true);
+
+/** Bind DN to access LDAP server (keep empty for anonymous bind) **/
+define('PLUGIN_PASSWD_LDAP_BIND_DN', "");
+
+/** Bind password to access LDAP server (keep empty for anonymous bind) **/
+define('PLUGIN_PASSWD_LDAP_BIND_PW', "");
 
 /** Set to true if you login with username@tenantname **/
 define('PLUGIN_PASSWD_LOGIN_WITH_TENANT', false);
diff --git a/php/class.passwdmodule.php b/php/class.passwdmodule.php
index cda26dd..f2f4a02 100644
--- a/php/class.passwdmodule.php
+++ b/php/class.passwdmodule.php
@@ -97,11 +97,23 @@ class PasswdModule extends Module
 				$uid = $data['username'];
 			}
 
+			// check if we should use tls!
+			if(strrpos(PLUGIN_PASSWD_LDAP_URI, "ldaps://", -strlen(PLUGIN_PASSWD_LDAP_URI)) === FALSE && PLUGIN_PASSWD_LDAP_USE_TLS === true) {
+				ldap_start_tls($ldapconn);
+			}
+
+			// set connection parametes
+			ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
+			ldap_set_option($ldapconn, LDAP_OPT_REFERRALS, 0);
+
+			// now bind to the ldap server to search the user dn
+			ldap_bind($ldapconn, PLUGIN_PASSWD_LDAP_BIND_DN, PLUGIN_PASSWD_LDAP_BIND_PW);
+
 			// search for the user dn that will be used to do login into LDAP
 			$userdn = ldap_search (
 				$ldapconn,						// connection-identify
 				PLUGIN_PASSWD_LDAP_BASEDN,		// basedn
-				'uid=' . $uid,		// search filter
+				'uid=' . $uid,					// search filter
 				array('dn')						// needed attributes. we need the dn
 			);
 
@@ -110,25 +122,34 @@ class PasswdModule extends Module
 				$userdn = $userdn[0]['dn'];
 
 				// bind to ldap directory
-				ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
-
 				// login with current password if that fails then current password is wrong
-				$bind = ldap_bind($ldapconn, $userdn, $data['current_password']);
+				ldap_bind($ldapconn, $userdn, $data['current_password']);
 
 				if(ldap_errno($ldapconn) === 0) {
-					$passwd = $data['new_password'];
-					$passwdRepeat = $data['new_password_repeat'];
 
-					if($this->checkPasswordStrenth($passwd)) {
+					$passwd = $data['new_password'];
+
+					if ($this->checkPasswordStrenth($passwd)) {
 						$password_hash = $this->sshaEncode($passwd);
 						$entry = array('userPassword' => $password_hash);
-						$return_mod = ldap_modify($ldapconn, $userdn, $entry);
+						ldap_modify($ldapconn, $userdn, $entry);
 						if (ldap_errno($ldapconn) === 0) {
 							// password changed successfully
 
 							// write new password to session because we don't want user to re-authenticate
 							session_start();
-							$_SESSION['password'] = $passwd;
+							// if user has openssl module installed
+							if(function_exists("openssl_encrypt")) {
+								// In PHP 5.3.3 the iv parameter was added
+								if(version_compare(phpversion(), "5.3.3", "<")) {
+									$_SESSION['password'] = openssl_encrypt($passwd,"des-ede3-cbc",PASSWORD_KEY,0);
+								} else {
+									$_SESSION['password'] = openssl_encrypt($passwd,"des-ede3-cbc",PASSWORD_KEY,0,PASSWORD_IV);
+								}
+							}
+							else {
+								$_SESSION['password'] = $passwd;
+							}
 							session_write_close();
 
 							// send feedback to client
@@ -172,32 +193,60 @@ class PasswdModule extends Module
 	{
 		$errorMessage = '';
 		$passwd = $data['new_password'];
-		$passwdRepeat = $data['new_password_repeat'];
 
-		if($this->checkPasswordStrenth($passwd)) {
-			// all information correct, change password
-			$store = $GLOBALS['mapisession']->getDefaultMessageStore();
-			$userinfo = mapi_zarafa_getuser_by_name($store, $data['username']);
-
-			if (mapi_zarafa_setuser($store, $userinfo['userid'], $data['username'], $userinfo['fullname'], $userinfo['emailaddress'], $passwd, 0, $userinfo['admin'])) {
-				// password changed successfully
-
-				// write new password to session because we don't want user to re-authenticate
-				session_start();
-				$_SESSION['password'] = $passwd;
-				session_write_close();
-
-				// send feedback to client
-				$this->sendFeedback(true, array(
-					'info' => array(
-						'display_message' => dgettext("plugin_passwd", 'Password is changed successfully.')
-					)
-				));
+		// get current session password
+		$sessionPass = $_SESSION['password'];
+		// if user has openssl module installed
+		if (function_exists("openssl_decrypt")) {
+			if (version_compare(phpversion(), "5.3.3", "<")) {
+				$sessionPass = openssl_decrypt($sessionPass, "des-ede3-cbc", PASSWORD_KEY, 0);
 			} else {
-				$errorMessage = dgettext("plugin_passwd", 'Password is not changed.');
+				$sessionPass = openssl_decrypt($sessionPass, "des-ede3-cbc", PASSWORD_KEY, 0, PASSWORD_IV);
+			}
+
+			if (!$sessionPass) {
+				$sessionPass = $_SESSION['password'];
+			}
+		}
+
+		if($data['current_password'] === $sessionPass) {
+			if ($this->checkPasswordStrenth($passwd)) {
+				// all information correct, change password
+				$store = $GLOBALS['mapisession']->getDefaultMessageStore();
+				$userinfo = mapi_zarafa_getuser_by_name($store, $data['username']);
+
+				if (mapi_zarafa_setuser($store, $userinfo['userid'], $data['username'], $userinfo['fullname'], $userinfo['emailaddress'], $passwd, 0, $userinfo['admin'])) {
+					// password changed successfully
+
+					// write new password to session because we don't want user to re-authenticate
+					session_start();
+					// if user has openssl module installed
+					if (function_exists("openssl_encrypt")) {
+						// In PHP 5.3.3 the iv parameter was added
+						if (version_compare(phpversion(), "5.3.3", "<")) {
+							$_SESSION['password'] = openssl_encrypt($passwd, "des-ede3-cbc", PASSWORD_KEY, 0);
+						} else {
+							$_SESSION['password'] = openssl_encrypt($passwd, "des-ede3-cbc", PASSWORD_KEY, 0, PASSWORD_IV);
+						}
+					} else {
+						$_SESSION['password'] = $passwd;
+					}
+					session_write_close();
+
+					// send feedback to client
+					$this->sendFeedback(true, array(
+						'info' => array(
+							'display_message' => dgettext("plugin_passwd", 'Password is changed successfully.')
+						)
+					));
+				} else {
+					$errorMessage = dgettext("plugin_passwd", 'Password is not changed.');
+				}
+			} else {
+				$errorMessage = dgettext("plugin_passwd", 'Password is weak. Password should contain capital, non-capital letters and numbers. Password should have 8 to 20 characters.');
 			}
 		} else {
-			$errorMessage = dgettext("plugin_passwd", 'Password is weak. Password should contain capital, non-capital letters and numbers. Password should have 8 to 20 characters.');
+			$errorMessage = dgettext("plugin_passwd", 'Current password does not match.');
 		}
 
 		if(!empty($errorMessage)) {
@@ -222,7 +271,6 @@ class PasswdModule extends Module
 	 */
 	public function checkPasswordStrenth($password)
 	{
-		// @FIXME should be moved to client side
 		if (preg_match("#.*^(?=.{8,20})(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9]).*$#", $password)) {
 			return true;
 		} else {