Same bug in openldap-2.4.40-13.el7.  The following patch will fix it:

--- a/openldap-2.4.40/libraries/libldap/tls_m.c
+++ b/openldap-2.4.40/libraries/libldap/tls_m.c
@@ -1590,12 +1590,15 @@ tlsm_add_key_from_file( tlsm_ctx *ctx, const char *filename )
                           filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
                retcode = -1;
        } else {
+               PK11SlotInfo *tmp;
                tlsm_add_pem_obj( ctx, key );
                retcode = 0;

                /* When adding an encrypted key the PKCS#11 will be set as removed */
                /* This will force the token to be seen as re-inserted */
-               SECMOD_WaitForAnyTokenEvent( pem_module, 0, 0 );
+               tmp = SECMOD_WaitForAnyTokenEvent( pem_module, 0, 0 );
+               if ( tmp )
+                       PK11_FreeSlot( tmp );
                PK11_IsPresent( slot );
        }


+++ This bug was initially created as a clone of Bug #1444860 +++

Description of problem:
The PKCS #11 slot object returned by SECMOD_WaitForAnyTokenEvent() is leaked, which later prevents nss-pem from being unloaded.


Version-Release number of selected component (if applicable):
curl-7.29.0-42.el7


Steps to Reproduce:
1. install nss-pem-1.0.3-2.el7
2. load a private key from file using libcurl


Actual results:
nss-pem fails to unload


Expected results:
nss-pem unloads properly


Additional info:
This bug was revealed by the following nss-pem commit:
https://github.com/kdudka/nss-pem/commit/eefef228

Unfortunately, reverting the commit would reintroduce the one second sleep after loading a private key, which is something we do not want to do?

--- Additional comment from Kamil Dudka on 2017-04-25 14:17:12 CEST ---

upstream commit:

https://github.com/curl/curl/commit/curl-7_54_0-24-gc8ea86f

--- Additional comment from Kamil Dudka on 2017-04-25 16:48:07 CEST ---

Removing the Regression keyword.  The bug is triggered by a change in nss-pem, so the change will be reverted.