So the issue here is either openldap is not finding the correct
hostname, or the hostname in the certificate subject is wrong.
As I stated previously, my domain name and cert is good. Even the reverse dns record is correct.
I tried replacing the certificate with an incorrect one (with invalid CN) and the error displayed in log is the very same. So yes, it looks like “something” does not match (but what?)
Connecting to ldap server itself works, even openssl s_client verifies the server cert ok (including the chain, what was a nice surprise to me).
In cn=RSA,cn=encryption,cn=config, I use nsSSLPersonalitySSL='CN=ldap-master-b[01].
example.com’.
I tried changing the errorlog-level as you suggested, but I got no better message than...
[09/May/2018:21:13:25 +0200] NSMMReplicationPlugin - agmt="cn=
rw-to-ldap-master-b02.example.com" (ldap-master-b02:636): binddn = cn=MasterMasterReplicationManager,cn=config, passwd = {AES-TUhNR0NTcUdTSWIzRFFFRkRUQm1NRVVHQ1NxR1NJYjNEUUVGRERBNEJDUXhZamN5WXpNeVppMDNPR00zTXpOaA0KTUMxaE1XTmtabUl5WmkwMVpUVmtOR1l5TlFBQ0FRSUNBU0F3Q2dZSUtvWklodmNOQWdjd0hRWUpZSVpJQVdVRA0KQkFFcUJCRDBuaTFJaDRXMmZDcnlqWUtXQmlMRw==}yFb3FVwDwpWKupgUWiS4wg==
[09/May/2018:21:13:26 +0200] slapi_ldap_bind - Error: could not send bind request for id [cn=MasterMasterReplicationManager,cn=config] authentication mechanism [SIMPLE]: error -1 (Can't contact LDAP server), system error -5987 (Invalid function argument.), network error 115 (Operation now in progress, host "
ldap-master-b02.example.com:636”)
root@ldap-master-b01:~# host 100.127.177.145