From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.7.2)
Gecko/20040806

Description of problem:
It should be possible to issue ldap_start_tls_s() against an OpenLDAP
server that is not configured for TLS and simply have TLS not be
negotiated.  Unfortunately, this is not the case: the connection to
the LDAP server becomes unusable.   You can test this quite easily
with ldapsearch:

Version-Release number of selected component (if applicable):
openldap-2.0.27-17

How reproducible:
Always

Steps to Reproduce:
1. Install openldap and make sure that the TLS lines are commented out
in /etc/openldap/slapd.conf
2. Start the ldap server
3. Run, for example, "ldapsearch -Zxh localhost objectclass=*"
    

Actual Results:  Instead of getting something, anything, back from the
LDAP server you get an error like this:

ldap_start_tls: Connect error
        additional info: error:14077410:SSL
routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
ldap_bind: Can't contact LDAP server
        additional info: error:14077410:SSL
routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure


Expected Results:  An indication that TLS cannot be negotiated, and
then carry on without TLS.  The "-ZZ" option for ldapsearch requires
that TLS is negotiated.

Additional info:

Another completely different implementation of an LDAP server that
doesn't support TLS at all works just fine: "ldapsearch -Z" reports
that TLS couldn't be negotiated, but the search carries on.