OpenLDAP proxy referral via SSL

I am trying to set up an OpenLDAP server (2.40) on CentOS 6 that uses a proxy referral to another LDAP server (OpenDJ) , all via SSL/TLS

The referral works if I do not use SSL but when I configure slapd.conf to require certs, I get an invalid password error:

res_errno: 49, res_error: <Invalid password.>, res_matched: <>

The proxy is configured to use SASL EXTERNAL binding but when connecting to the OpenDJ service, it binds anonymously:

ldap_back_dobind_int: DN="<certificate DN>" without creds, binding anonymouslyldap_sasl_bind

The same configuration works on Windows using OpenLDAP 2.38

Here is the configuration for the ldap backend in slapd.conf:

database ldap
suffix "ou=organization unit, o=organization"
uri "ldaps://test.ldap.com:636/"

chase-referrals yes
idassert-bind bindmethod=sasl
saslmech=EXTERNAL
binddn="O=ORG,OU=ORGUNIT,C=US"
tls_cacert="/path/to/ca cert.pem"
tls_cert="/path/to/server cert.pem"
tls_key="/path/to/server key.pem"
tls_reqcert=demand
mode=self

Thank you