I'm using NSS-LDAP for authentication. Without TLS, everything works fine. Once I enable TLS (StartTLS) with a self-signed certificate, which I have added to the client, NSS-LDAP won't connect to the LDAP server.
systemctl status nscd
gives
nss-ldap: do_open: do_start_tls failed:stat=-1
nss_ldap: could not search LDAP server - Server is unavailable
I can connect to the server with ldapsearch -Z ...
without any problems.
My /etc/ldap.conf
looks like this:
...
uri ldap:///192.168.8.8
...
ssl start_tls
tls_cacertdir /etc/ssl/certs