I am trying to set up an OpenLDAP server (2.40) on CentOS 6 that uses a proxy referral to another LDAP server (OpenDJ) , all via SSL/TLS

The referral works if I do not use SSL but when I configure slapd.conf to require certs, I get an invalid password error:

res_errno: 49, res_error: <Invalid password.>, res_matched: <>

The proxy is configured to use SASL EXTERNAL binding but when connecting to the OpenDJ service, it binds anonymously:

ldap_back_dobind_int: DN="<certificate DN>" without creds, binding anonymouslyldap_sasl_bind

The same configuration works on Windows using OpenLDAP 2.38

Here is the configuration for the ldap backend in slapd.conf:

database ldap suffix "ou=organization unit, o=organization" uri "ldaps://test.ldap.com:636/"

chase-referrals yes idassert-bind bindmethod=sasl saslmech=EXTERNAL binddn="O=ORG,OU=ORGUNIT,C=US" tls_cacert="/path/to/ca cert.pem" tls_cert="/path/to/server cert.pem" tls_key="/path/to/server key.pem" tls_reqcert=demand mode=self

Thank you