Hi! It was easy running the slaptest utility -- you are correct. The output wasn't so easy to figure out with duplicate schema entries, tls being dropped, etc. I saw that redhat uses nss and I'll have to confess that I don't understand the technical and political reasons for this. They (redhat) allege at it should be transparent to me.
The dropping of the TLS directives doesn't happen with an OpenSSL linked build. That's entirely my point. Duplicate schema entries doesn't occur with a standard openldap installation, and would have caused problems regardless of whether or not you were using cn=config. I.e., you had an invalid 2.3 configuration that is caught in 2.4, using slapd.conf or slapd-config.
--Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration