https://bugs.openldap.org/show_bug.cgi?id=10023
--- Comment #12 from Howard Chu hyc@openldap.org --- To be clear: I'm going with option #1 for the fix.
Historically, OpenLDAP has always done TLS initialization synchronously. I think changing that is out of scope.