Description of problem:
When ldap_set_option is used to set the TLS parameters such as CACERTDIR, CERTFILE, and KEYFILE, the settings are unused.  This is because in tls2.c, alloc_handle is called with a null context.  In case of null context, alloc_handle will use the global options to initialize the TLS parameters -- the LDAP handle's options are not available.

OpenLDAP on RHEL6 seems to be using Mozilla NSS, and its deferred initializer function is called only on this initial alloc_handle.  Therefore it only loads certificate authorities from the global default location and does not define a client certificate or key at all.

Setting these values through the environment is the only workaround.

Version-Release number of selected component (if applicable):
Current as of bug report (2.4.23-32)

How reproducible:
Always

Steps to Reproduce:
1.  Set the TLS options programmatically through ldap_set_option
2.  Attempt to connect to a SSL LDAP server

Actual results:
Failure to exchange proper certificates.  If the server certificate is self-signed and not stored in the default CA certificates location, server certificate verification will fail.

Expected results:
Proper SSL negotiation with the expected certificate and CA trusts.

Additional info:
This may be the cause of Bug 760856