These entries look fine. I'm assuming you are running this on a hub or consumer, is that correct? Does it work correctly on the supplier replica? I think the "nsslapd-state=referral on update" might be tripping up the healthcheck.
Yes I am using this as a hub. The same ldif I use to make the suffix I use to make the suppliers and consumers, and they work fine (and dsctl healthcheck says they are ok). The setting of nsslapd-state was set by the dsconf command I sent before. I checked a production hub I have (which this one will eventually replace), and that is the correct setting.
Perhaps this is an issue with dsctl's healthcheck then.
-Gary