StartTLS with a host alias

[Robert Minsk <robertminsk@yahoo.com>]

My cert on my LDAP server contains multiple commonName entries.
> openssl x509 -noout -in s014-ldap-cert.pem -subject
subject= /C=US/ST=California/O=FooBar/CN=s014.cgi.foobar.com/CN=ldap1.cgi.foobar.com/CN=s14.cgi.foobar.com

The LDAP server FQHN is s014.cgi.foobar.com and has aliases of ldap1.cgi.foobar.com and s14.cgi.foobar.com.  All hostname resolution is done with our internal DNS servers and they all have the correct FQHN and aliases.

On my secondary mirror LDAP server I have syncrepl setup to use the hostname alias ldap1.cgi.foobar.com
syncrepl  ... provider=ldap://ldap1.cgi.foobar.com starttls=critical ...
and that works fine.

When I have my ldap.conf with:
URI ldap://s014.cgi.foobar.com
the command "ldapsearch -x -ZZ" works just fine.

When I change my ldap.conf to:
URI ldap://ldap1.cgi.foobar.com
the command "ldapsearch -x -ZZ" returns
ldap_start_tls: Connect error (-11)
        additional info: TLS: hostname does not match CN in peer certificate.

It seems the openldap library is only checking the first CN in the certificate and not all the others.  Is there any way to have it check the other CN entries in the cert?