Looking at the debug log, it is expired.  It puzzle me because the certs on the other two machine are working correctly.

Since this is the case (certificate expires), is it safe to create a new one for this machine?

Gavin Henry wrote: 
----- "Ivan Ordonez" <iordonez@nature.berkeley.edu> wrote:

  
Hi,

Our environment is consist of 3 domain controllers - 1 primary and 2 
backup.  All domain controller are running on Gentoo platform using 
Samba with Openldap for user login and authentication.  One of the 
backup domain controller has been acting up lately and will not start

samba properly.  A quick look at the log showed:

slapd[22380]: conn=94 op=0 RESULT oid= err=0 text=
slapd[22380]: conn=94 fd=11 closed (TLS negotiation failure)
slapd[22380]: conn=95 fd=11 ACCEPT from IP=127.0.0.1:54158
(IP=0.0.0.0:389)

It seems obvious that the issue is with certificate.  The certificate
we 
are using was created using the primary domain controller and were
then 
copied to both backup domain controller.  If I create a brand new 
certificate using the backup domain controller having certificate
issue, 
will that interfere with the certificate on the primary domain 
controller?  Will that cause confusion on the domain? Creating a brand

new certificate is the only solution I can think of to fix this issue.
    

http://www.openldap.org/faq/data/cache/185.html

Has one of your certs expired? By default OpenSSL scripts do 365 days.