ssl / TLS Universal Forwarder SA-LDAPSerach

Hi, Is it possible or does it make sense to install the sa-ldapsearch on the domaincontroller with the universal forwarder? the topologie is as follows: Domaincontroller with universal Forwarder ---> WAN -->> HeavyForwarder DMZ ---> Indexer LAN. The problem is there is no VPN form Indexer to the Domaincontroller. I have to use the ssl/tls encryption but i am not allowed to change any firewall settings. My Problem is how can sa-ldapserach authenticate to the DC? any Ideas? how could we design this??? thanks