I _think_ that the problem was that the LDAP server certificate was just a regular SSL certificate and it needed recreating as a "server" certificate (build-key-server from easy-rsa tools):
nsCertType = server
extendedKeyUsage=serverAuth
keyUsage = digitalSignature, keyEncipherment
I _think_ that the problem was that the LDAP server certificate was just a regular SSL certificate and it needed recreating as a "server" certificate (build-key-server from easy-rsa tools): e=serverAuth
nsCertType = server
extendedKeyUsag
keyUsage = digitalSignature, keyEncipherment