On debian, /etc/ssl/private is only readable by root and members of ssl-cert.
You ćan either add your openldap user to this group or move your certificate to /etc/ldap.
Best regards
Ulf
Yes, and I believe it was different with Stretch version. We checked permission with su on openldap account(temporarily replace /bin/false with /bin/bash), and solved issue.
Thank you for your help!