When I'm using a SRV DNS record, what name(s) do I put in the TLS certificate? For example, if I'm setting up slapd on two servers (klas1 and klas2), and I define these DNS records (using bind zone file style notation):
_ldap._tcp.example.com. IN SRV 10 0 389 klas1.example.com. _ldap._tcp.example.com. IN SRV 20 0 389 klas2.example.com. klas1.example.com. A 192.168.0.1 klas2.example.com. A 192.168.0.2
I'd expect my clients would be configured to connect to ldap://example.com/. However when I'm generating TLS certificates on the servers, do I generate them with the name "example.com", or do I generate them with the name "klas1.example.com", or do I need both?