The ssl.c code will use the attribute nsTLS1 if defined, but there is no such attribute defined by the schema, nor will nsEncryptionConfig allow it. We need to add this attribute to the schema and to objectclass nsEncryptionConfig.
Upstream ticket: https://fedorahosted.org/389/ticket/24
This was fixed in 389-ds-base-1.2.11-0.1.a1.fc17. Closing.