The answers to this question say that it seems not to be possible to store more than one usercertificate in one entry because openldap does not support certificate matching.
You can also use LDAP_MOD_REPLACE to replace all userCertificate values at once.
You cannot LDAP_MOD_DEL a certain value of userCertificate.
Ciao, Michael.