[389-users] secure replication failing

[Elizabeth Jones]

I have multimaster replication set up on 4 LDAP servers but can't get
secure replication working on one of the servers. The setup is like this
--

     data center 1                    data center 2

       ldap1       <------->             ldap1

        ^ |                              ^  |
        / |                              |  |
        | v                              |  v

       ldap2                             ldap2


each server has its own self-signed cert.

I can successfully replicate in all the directions indicated except for
replication from data center1 ldap2 to data center1 ldap1.

I know that I have the right certificate on ldap2. I can ldapsearch -ZZ
from ldap2 to ldap1 successfully using this certificate.  I can
successfully replicate from data center 2 ldap1 to data center1 ldap1
using this certificate. But replication refuses to work from DC1 ldap2 to
DC1 ldap1!!!!

The logs say LDAP error: Can't contact LDAP server. Error Code: -1.

I've disabled iptables on both data center 1 ldaps. I've rebuilt the
replication agreement a dozen times. I've ldapsearch -zz'ed a dozen times.
 I've reinstalled the CA certificate (using the one from my openldap
directory, so I know that it is the same one that is working for
ldapsearch -ZZ, as well as exporting it from ldap1 again and reinstalling
it). What else can I possibly do to get this working?

These are my rpms -
# rpm -qa | grep 389
389-ds-base-libs-1.2.11.25-1.el6.x86_64
389-ds-console-1.2.6-1.el6.noarch
389-admin-1.1.35-1.el6.x86_64
389-ds-base-1.2.11.25-1.el6.x86_64
389-admin-console-1.1.8-1.el6.noarch
389-console-1.1.7-1.el6.noarch
389-adminutil-1.1.19-1.el6.x86_64
openssl-1.0.1e-16.el6_5.4.x86_64

# uname -a
Linux dc1-ldap2 2.6.32-431.5.1.el6.x86_64