I inherited a pair  of (interestingly configured) ldap servers from a previous owner and I'm trying to get them to replicate to each other (actually, starting with two new VM copies, with the goal of ending up with four masters spread over two data centers). The VM's are running  RHEL6 and openldap 2.4.40.

When I try to add replication using the  ldif included at the bottom of this post , I get this error and then cannot restart slapd
--
[root@ldap01 tmp]#  ldapmodify  -Y  EXTERNAL -H ldapi:/// -f /tmp/repl.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"

adding new entry "olcOverlay=syncprov,olcDatabase={2}bdb,cn=config"

modifying entry "olcDatabase={2}bdb,cn=config"
ldap_modify: Object class violation (65)
        additional info: attribute 'olcTLSCertificateFile' not allowed
--

slapd restart error in the log is
read_config: no serverID / URL match found. Check slapd -h arguments.

(I assume this is coming from my three new syncprov providers which have nothing to provide?)

The only reference I found to TLS anywhere was here

[root@ldap01 tmp]# slapcat -s olcDatabase=\{2}bdb,cn=config |grep TLS
olcTLSCertificateFile: /etc/pki/tls/certs/foobar_cert.pem
olcTLSCertificateKeyFile: /etc/pki/tls/certs/foobar_key.pem

Those files do not exist, never have!
 (I admit I tried, and failed, to delete the reference)

What can I do to fix the TLS error? Where is there a TLS dependency in this picture? Thank you for any clues!

[root@ldap01 tmp]# cat post.ldif
olcServerID: 1 ldap://ldap02.example.com
olcServerID: 2 ldap://ldap2.example.com
olcServerID: 3 ldap://ldap.example.com

dn: olcOverlay=syncprov,olcDatabase={2}bdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov

dn: olcDatabase={2}bdb,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=001
  provider=ldap://ldap02.example.com
  binddn="uid=Manager,dc=example,dc=com"
  bindmethod=simple
  credentials="managerpassword"
  searchbase="dc=example,dc=com"
  type=refreshAndPersist
  retry="60 +"
  timeout=1
olcSyncRepl: rid=002
  provider=ldap://ldap2.example.com
  binddn="uid=Manager,dc=example,dc=com"
  bindmethod=simple
  credentials="managerpassword"
  searchbase="dc=example,dc=com"
  type=refreshAndPersist
  retry="60 1 300 12 7200 +"
  timeout=1
olcSyncRepl: rid=003
  provider=ldap://ldap.example.com
  binddn="uid=Manager,dc=example,dc=com"
  bindmethod=simple
  credentials="managerpassword"
  searchbase="dc=example,dc=com"
  type=refreshAndPersist
  retry="60 1 300 12 7200 +"
  timeout=1
-
add: olcMirrorMode
olcMirrorMode: TRUE



thank you very much!