Of course, i realize ten seconds after i post my message that i omitted the -ZZ in the first command line. Here's the output of the correct one: $ ldapsearch -h <server> -x -ZZ -s base -b "" supportedSASLMechanisms ldap_start_tls: Protocol error I'll go find ldap_start_tls() and figure out where things start to go bad.