This message was deleted.

A basic thought but I'm assuming you are already using 636 for your LDAP connection to your DCs to actually allow for password changes? Other than that I have just used Carl's guide in the past for testing it in the lab https://carlstalhood.com/self-service-password-reset-citrix-adc/

changed port to 636 and added the user id that is in my LDAP server to domain admins group in AD. This resolved the issue. Thanks @Aaron O'Reilly Can't we use plain text in LDAP server and use it for SSPR ?

Secure LDAP is an AD DC requirement for allowing password changes.

Thank you.