My end goal is to use sssd and Google LDAPS but can tell if things will work with ldapsearch. Google LDAPS requires the Server Name Indication (SNI) extension. I have it working on Ubuntu 20.04 with a work around. Noted by the openldap maintainer ldapsearch can be made to work with the GnuTLS cipher suite 'NORMAL:!VERS-TLS1.3' forcing TLS1.2 which appears to do SNI.
LDAPTLS_CIPHER_SUITE='NORMAL:!VERS-TLS1.3' ./clients/tools/ldapsearch -H ldaps://ldap.google.com -x
The maintainer does not note a work around for ldapsearch compiled with openssl such as on CentOS 8. So as a test I compiled openldap 2.4.53 on CentOS 8 using --with-tls=gnutls to see if a replacement of openldap compiled with GnuTLS on CentOS 8 would accept the cipher to block TLS1.3 and provide the necessary SNI. This did not work (though the cipher seems to be acceptable given it does not produce an error), Google LDAPS still does not get its SNI so sends back an invalid certificate. And thus I'm stuck.
CentOS 8 (openldap[-clients]-2.4.46-10) and Ubuntu 20.04 (libldap-2.4-2 and ldap-utils 2.4.49+dfsg-2ubuntu1.3)
Anyone know how to get openldap (which is compiled with openssl) on CentOS 8 to send SNI such that it will work with Google LDAPS?