tls for openldap

Client: /etc/openldap/ldap.conf
Server: /etc/openldap/slapd.conf

TLS_CACERT: ca cert that you need to verify the certs provided by slapd
TLS_CACERTDIR: all root certs, make symbolinks between actual root certs and their ${X509_HASH}.0
TLS_CERT: user-only directive, used in .ldaprc, or in sasl external bind, say in syncrepl consumer
TLS_KEY: the private key that pairs with the pub key in the above cert

TLS_REQCERT: by default, demand. If you dont have proper ca cert, your handshake fails.

Server:

TLSCACertificateFile: the ca cert that slapd trust. You can append multiple ca certs to the same file or
TLSCACertificatePath: same as TLS_CACERTDIR, make sure use hash symlinks, since binaries are linked against openssl libraries. openssl looks up ca cert based on hashes

TLSCertificateFile: like tls_cert, this is for server. Make sure certs' subject cn is $(hostname -f). If you got multiple aliases, make use of the ssl extention: SubjectAltName

TLSCertificateKeyFile: the private key that pairs with the above

TLSVerifyClient: by default, never. Same as TLS_REQCERT
options:

allow: ask; if client can't present a cert or server can't verify cert, connection is allowed
try:ask; if client can't present, allowed; if server can't verify, connection is terminated
demand: demand client's cert and connection is allowed iff clients cert is verified
none: don't ask.

demand > try > allow > none

If you want SASL external bind, make sure you use one of these: demand, try, allow

TLSCipherSuite: be careful when you set this. by default, that is, when you dont define this directive, it accepts any ciphers (of course, symmetric) $(openssl ciphers -v ALL). You can choose a subset, like HIGH:MEDIUM:+SSLv2; in which case, client and server can fix on one cipher. If you define to use just one cipher, make sure all your clients that cipher.

For instance, check such a case,
http://serverfault.com/questions/138286/configuring-openldap-and-ssl

Why one needs cipher?

Public keys are used to generate a session key: cf. Diffie Hellman Key exchange.

This session key, along with salt, if any, is used to encrypt the tunnel. This encryption is symmetric. Of course, you see hashing, etc. Symmetric key encryption is faster than public key encryption;however, for the former, ya need a way to agree upon a symmetric key, a key shared by both: here, DH scheme helps.

SSL, SSH, IPSEC, etc, all follow the same path.