3) if you are NOT using self sign cert, then ignore point 2). 4) I leave it to the mail list to provide more comment if OpenLDAP has to be configured properly to support Natural Language