https://bugs.openldap.org/show_bug.cgi?id=10321
--- Comment #2 from jnabasny@gmail.com --- Thanks for the reply, Howard. When you say "failed to parse", couldn't that be caused by the partial transcription?
Also, I've confirmed the inetOrgPerson schema is loaded, which contains the userCertificate attributetype. As far as I know, this filter doesn't depend on anything else. Are there some other pre-requisites you are aware of?