Prerequisite: AD has started certificate service (the most important sentence).

import ldap3

SERVER = 'adserver'
BASEDN = "DC=example,DC=com"
USER = "[email protected]"
CURREENTPWD = "adcvQ.SAD"
NEWPWD = "adcv.Q.SAD"

SEARCHFILTER = '(&(userPrincipalName='+USER+')(objectClass=person))'

USER_DN = ""
USER_CN = ""

ldap_server = ldap3.Server(SERVER, get_info=ldap3.ALL, use_ssl=True)
conn = ldap3.Connection(ldap_server, USER, CURREENTPWD, auto_bind=True)
conn.start_tls()

conn.search(search_base=BASEDN, search_filter=SEARCHFILTER, search_scope=ldap3.SUBTREE, attributes=['cn', 'givenName', 'userPrincipalName'], paged_size=5)

# print(conn.response)
for entry in conn.response:
    if entry.get("dn") and entry.get("attributes"):
        if entry.get("attributes").get("userPrincipalName"):
            if entry.get("attributes").get("userPrincipalName") == USER:
                USER_DN = entry.get("dn")
                USER_CN = entry.get("attributes").get("cn")


if USER_DN:
    res = ldap3.extend.microsoft.modifyPassword.ad_modify_password(conn, USER_DN, NEWPWD, CURREENTPWD,  controls=None)
    if res:
        print('user %s change password Success.' % USER_CN)
    else:
        print('user %s change password Failed.' % USER_CN)
else:
    print("User DN is missing!")