Currently /etc/openldap/ldap.conf has the following reference to CA store:

  TLS_CACERTDIR /etc/openldap/cacerts

This is a specific store for openldap in openssl's nss certdir. By default this directory has an empty database.

# certutil -L -d /etc/openldap/certs/

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI
ldapsearch and other utilities cannot be used to access ssl/startTLS servers with valid system wide trusted certificate chains.

ca-certificates package provide update-ca-trust utility to manage the system trust, for openssl it manages /etc/pki/tls/certs/ca-bundle.crt (/etc/ssl/certs which is symlink to /etc/pki/tls/certs),  openldap uses openssl.

openldap package can be integrated to use this system wide store by adding the following into /etc/openldap/ldap.conf:

  TLS_CACERT /etc/pki/tls/certs/ca-bundle.crt

Or by updating ca-certificates package to also manage nss store in addition to openssl.

Integrating openldap into the system wide trust by default will enable easier and more secure management of system trust.