diff --git a/lib/net/ldap.rb b/lib/net/ldap.rb
index a9c843e7..0447ed0c 100644
--- a/lib/net/ldap.rb
+++ b/lib/net/ldap.rb
@@ -540,6 +540,9 @@ def initialize(args = {})
     @base = args[:base] || DefaultTreebase
     @force_no_page = args[:force_no_page] || DefaultForceNoPage
     @encryption = args[:encryption] # may be nil
+    if @encryption && !@encryption.is_a?(Hash)
+      raise ArgumentError, "encryption must be given as Hash"
+    end
     @connect_timeout = args[:connect_timeout]
 
     if pr = @auth[:password] and pr.respond_to?(:call)
diff --git a/test/test_ldap.rb b/test/test_ldap.rb
index 85325457..a1fd910a 100644
--- a/test/test_ldap.rb
+++ b/test/test_ldap.rb
@@ -91,4 +91,10 @@ def test_encryption
 
     assert_equal enc[:method], :start_tls
   end
+
+  def test_initializer_requires_hash_encryption
+    assert_raise ArgumentError, "encryption must be given as Hash" do
+      Net::LDAP.new encryption: [ :simple_tls ]
+    end
+  end
 end