Syncrepl TLS woes

Hello,

I am currently in the grips of trying to get syncrepl replication working with StartTLS. It was working fine until recently. The only change that occurred over the last 12 months (that relates to OpenLDAP) is that I've started requiring TLS for connections.

My provider is running OpenLDAP 2.4.31 on Ubuntu 14.04, while one consumer is running the exact same version on a Ubuntu 14.04 machine and the other consumer is running OpenLDAP 2.4.28 on Ubuntu 12.04.

The provider has, AFAIK, a correct TLS configuration, given that I can connect and search using the ldapsearch -ZZ utility from any of the servers.

The syncprov overlay is loaded and configured on the provider.

The consumers have the following (redacted, with unique rid values) olcSyncRepl:

olcSyncrepl: {0}rid=1 provider=ldap://[LDAP_DNS] bindmethod=simple bi
nddn="[SYNC_USER]" credentials=[SYNC_PASS] searchbase="[L
DAP_BASE]" logbase="cn=accesslog" logfilter="(&(objectClass=auditWr
iteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60
+" syncdata=accesslog starttls=critical tls_reqcert=demand

Unfortunately, on both consumers can't seem to be able to actually start the TLS connection:

slapd[1257]: slap_client_connect: URI=ldap://[LDAP_DNS] Error, ldap_start_tls failed (-11)
slapd[1257]: do_syncrepl: rid=001 rc -11 retrying

And the provider shows the following errors:

slapd[2126]: conn=1586 fd=100 ACCEPT from IP=[CONSUMER_IP]:35500 (IP=0.0.0.0:389)
slapd[2126]: conn=1586 op=0 EXT oid=1.3.6.1.4.1.1466.20037
slapd[2126]: conn=1586 op=0 STARTTLS
slapd[2126]: conn=1586 op=0 RESULT oid= err=0 text=
slapd[2126]: conn=1586 fd=100 closed (TLS negotiation failure)

Is there anything that I'm missing?

Cheers,
-- 
Xavier