Client doesn't send certificate for LDAPS

[Joshua Schaeffer <jschaeffer0922@gmail.com>]

    I'm in the process
          of setting up my slapd server to operate over
            LDAPS and having trouble when using a CA certificate (being
            my own certificate authority).  I've been able to setup
      LDAPS when using a self-signed server certificate:
      
      root@baneling:~# slapcat -H
        ldap:///cn=config??base
        dn: cn=config
        objectClass: olcGlobal
        cn: config
        olcArgsFile: /var/run/slapd/slapd.args
        olcLogLevel: none
        olcPidFile: /var/run/slapd/slapd.pid
        olcToolThreads: 1
        structuralObjectClass: olcGlobal
        entryUUID: 0e827846-3926-1033-9f74-632898b715c9
        creatorsName: cn=config
        createTimestamp: 20140306025210Z
        olcTLSCertificateFile: /etc/ssl/certs/ldap.harmonywave.com.crt
        olcTLSCertificateKeyFile:
        /etc/ssl/private/ldap.harmonywave.com.key
        olcTLSCipherSuite: SECURE256
        olcTLSVerifyClient: never
        entryCSN: 20140308131751.026022Z#000000#000#000000
        modifiersName:
        gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
        modifyTimestamp: 20140308131751Z
      
      This works fine and I'm able to authenticate
          clients.  However if I use a
              CA certificate (again, being my own CA) to sign my server
              certificate and then change olcTLSVerifyClient to demand and add
                  olcTLSCACertificateFile then I can no
                    longer authenticate.  I've installed my CA
                    certificate on the client machine
                      and pointed both ldap.conf and nslcd.conf to the CA certificate. 
                          However I get the following when
                            debugging:
                            
                          root@baneling:~# slapd -d conns -h
                          ldaps:///
                          531b1cef @(#) $OpenLDAP: slapd  (Apr 23 2013
                          12:16:04) $
                             
                          root@lupin:/tmp/buildd/openldap-2.4.31/debian/build/servers/slapd
                          531b1cf0 slapd starting
                          531b1cf0 daemon: added 3r listener=(nil)
                          531b1cf0 daemon: added 6r
                          listener=0x7fe2d98326e0
                          531b1cf0 daemon: added 7r
                          listener=0x7fe2d98327c0
                          531b1cf0 daemon: epoll: listen=6
                          active_threads=0 tvp=zero
                          531b1cf0 daemon: epoll: listen=7
                          active_threads=0 tvp=zero
                          531b1cf0 daemon: activity on 1 descriptor
                          531b1cf0 daemon: activity on:531b1cf0 
                          531b1cf0 daemon: epoll: listen=6
                          active_threads=0 tvp=zero
                          531b1cf0 daemon: epoll: listen=7
                          active_threads=0 tvp=zero
                          531b1cf4 daemon: activity on 1 descriptor
                          531b1cf4 daemon: activity on:531b1cf4 
                          531b1cf4 daemon: epoll: listen=6 busy
                          531b1cf4 daemon: epoll: listen=7
                          active_threads=0 tvp=zero
                          531b1cf4 daemon: activity on 1 descriptor
                          531b1cf4 daemon: activity on:531b1cf4 
                          531b1cf4 daemon: epoll: listen=6
                          active_threads=0 tvp=zero
                          531b1cf4 daemon: epoll: listen=7
                          active_threads=0 tvp=zero
                          531b1cf4 daemon: listen=6, new connection on
                          12
                          531b1cf4 daemon: added 12r (active)
                          listener=(nil)
                          531b1cf4 daemon: activity on 1 descriptor
                          531b1cf4 daemon: activity on:531b1cf4 
                          12r531b1cf4 
                          531b1cf4 daemon: read active on 12
                          531b1cf4 daemon: epoll: listen=6
                          active_threads=0 tvp=zero
                          531b1cf4 daemon: epoll: listen=7
                          active_threads=0 tvp=zero
                          531b1cf4 daemon: activity on 1 descriptor
                          531b1cf4 daemon: activity on:531b1cf4 
                          531b1cf4 daemon: epoll: listen=6
                          active_threads=0 tvp=zero
                          531b1cf4 daemon: epoll: listen=7
                          active_threads=0 tvp=zero
                          531b1cf4 daemon: activity on 1 descriptor
                          531b1cf4 daemon: activity on:531b1cf4 
                          531b1cf4 daemon: epoll: listen=6
                          active_threads=0 tvp=zero
                          531b1cf4 daemon: epoll: listen=7
                          active_threads=0 tvp=zero
                          531b1cf4 daemon: activity on 1 descriptor
                          531b1cf4 daemon: activity on:531b1cf4 
                          12r531b1cf4 
                          531b1cf4 daemon: read active on 12
                          531b1cf4 daemon: epoll: listen=6
                          active_threads=0 tvp=zero
                          531b1cf4 daemon: epoll: listen=7
                          active_threads=0 tvp=zero
                          TLS: can't accept: The peer did not send any
                          certificate..
                          531b1cf4 connection_closing: readying
                          conn=1000 sd=12 for close
                          531b1cf4 daemon: removing 12
                          531b1cf4 daemon: activity on 1 descriptor
                          531b1cf4 daemon: activity on:531b1cf4
                          
                          Why would the client not send
                            the certificate if I've pointed TLS_CACERT in
                                ldap.conf and tls_cacertfile
                              to that cert?  Maybe I'm misunderstanding
                                    the basic concepts here, I am pretty new to a
                                      lot of this.  I'm using OpenLDAP 2.4.31,
                                      Debian 7, and GnuTLS.  Yes, I'm aware of its recent critical security
                                          bug
                          and the warnings against it
                            from this group (http://www.openldap.org/lists/openldap-devel/200802/msg00072.html).
                              
                              Thanks,
                                  Joshua