https://bugs.openldap.org/show_bug.cgi?id=10321
--- Comment #1 from Howard Chu hyc@openldap.org --- The question mark in the logged filter indicates that the filter term was invalid.
Mar 20 19:54:01 ldap slapd[457]: conn=1058 op=3 SRCH base="ou=people,dc=nabasny,dc=com" scope=2 deref=0 filter="(&(?userCertificate;binary=
I.e., it failed to parse, or the requested filter type is not valid for that attributetype. As such nothing else is relevant. The transcription from hex values to decoded characters has no bearing on it.