# netstat -tlpn | grep slapd
tcp        0      0 0.0.0.0:636             0.0.0.0:*               LISTEN      30019/slapd
tcp        0      0 0.0.0.0:389             0.0.0.0:*               LISTEN      30019/slapd
tcp6       0      0 :::636                  :::*                    LISTEN      30019/slapd
tcp6       0      0 :::389                  :::*                    LISTEN      30019/slapd

# gnutls-cli-debug -p 636 localhost
Resolving 'localhost'...
Connecting to '127.0.0.1:636'...
Checking for TLS 1.1 support... yes
Checking fallback from TLS 1.1 to... N/A
Checking for TLS 1.0 support... yes
Checking for SSL 3.0 support... yes
Checking for HTTPS server name... not checked
Checking for version rollback bug in RSA PMS... no
Checking for version rollback bug in Client Hello... no
Checking whether we need to disable TLS 1.0... N/A
Checking whether the server ignores the RSA PMS version... no
Checking whether the server can accept Hello Extensions... yes
Checking whether the server can accept cipher suites not in SSL 3.0 spec... yes
Checking whether the server can accept a bogus TLS record version in the client hello... no
Checking for certificate information... N/A
Checking for trusted CAs... N/A
Checking whether the server understands TLS closure alerts... yes
Checking whether the server supports session resumption... no
Checking for export-grade ciphersuite support... no
Checking RSA-export ciphersuite info... N/A
Checking for anonymous authentication support... no
Checking anonymous Diffie-Hellman group info... N/A
Checking for ephemeral Diffie-Hellman support... no
Checking ephemeral Diffie-Hellman group info... N/A
Checking for AES cipher support (TLS extension)... yes
Checking for CAMELLIA cipher support (TLS extension)... yes
Checking for 3DES cipher support... yes
Checking for ARCFOUR 128 cipher support... yes
Checking for ARCFOUR 40 cipher support... no
Checking for MD5 MAC support... yes
Checking for SHA1 MAC support... yes
Checking for LZO compression support (GnuTLS extension)... no
Checking for max record size (TLS extension)... yes
Checking for SRP authentication support (TLS extension)... yes
Checking for OpenPGP authentication support (TLS extension)... no

openssl genrsa -out ldap.key 1024
openssl req -new -key ldap.key -out ldap.csr
openssl genrsa -des3 -out ca.key 2048
openssl req -new -x509 -days 365 -key ca.key -out ca.cert
openssl x509 -req -in ldap.csr -out ldap.cert -CA ca.cert \
 -CAkey ca.key -CAcreateserial -days 365

c_rehash /etc/ssl/certs/

[viking@work ~]$ cat /etc/openldap/ldap.conf 
#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE	dc=example,dc=com
#URI	ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT	12
#TIMELIMIT	15
#DEREF		never
URI ldaps://localhost
BASE dc=virtual
TLS_CACERTDIR /etc/openldap/cacerts

[viking@work ~]$ ls -l /etc/openldap/cacerts
total 8
lrwxrwxrwx. 1 root root   12 сент.  2  2011 23bcbcb2.0 -> myrootcert1.pem
lrwxrwxrwx. 1 root root    8 сент.  2  2011 f3deb654.0 -> myrootcert2.pem
-rw-r--r--. 1 root root 1229 сент.  2  2011 myrootcert1.pem
-rw-r--r--. 1 root root 1350 сент.  2  2011 myrootcert2.pem

# ls -l | grep ldap
lrwxrwxrwx 1 root root        13 Мар 18 17:07 02883b71.0 -> ldap_cert.pem
-rw-r--r-- 1 root root      1164 Мар 18 17:04 ldap_cert.pem

# ls -l | grep cacert.pem
lrwxrwxrwx 1 root root        10 Мар 18 17:07 b9cf35f6.0 -> cacert.pem
-rw-r--r-- 1 root root      1074 Мар 18 17:00 cacert.pem

# cat /etc/ldap/ldap.conf

URI ldaps://localhost
BASE dc=Домен,dc=ru
TLS_CACERTDIR /etc/ssl/certs

ldapsearch -H ldaps://hostname/ -LLL -D cn=admin,dc=домен,dc=ru -W -b "ou=Город,dc=домен,dc=ru" "cn=Бокова*"
Enter LDAP Password:

TLS established tls_ssf=128 ssf=128

# cat ldap.conf
TLS_CACERT      /etc/ssl/certs/cacert.pem

man update-ca-trust