I assume this is running RHEL 6?
On both masters I'd compare the output of
$ ldapsearch -LLL -x -D 'cn=directory manager' -W -h `hostname` -p 7389 -b uid=ipara,ou=people,o=ipaca description
What date did you go back to? Are the new certificates still valid on that date?
rob