I am trying to find a way to get openldap (client-side, RedHat 7.6) to only accept one particular TLS server certificate for a particular server, and rejects any other certificate, even if it was issued by the same CA - basically, I want to pin the TLS certificate. Of course in a perfect world, there shouldn't be any other valid certificates, but I want to protect against unauthorized certificates.
I didn't find any explicit documentation about how to do that.
One hunch I have is that I could manipulate the file listed in TLSCACertificateFile by removing all CAs, and then adding only the one authorized certificate itself.
That seems to violate the documentation, though (emphasis mine):
This directive specifies the PEM-format file containing certificates for the CA's that slapd will trust. The certificate for the CA that signed the server certificate must be included among these certificates. If the signing CA was not a top-level (root) CA, certificates for the entire sequence of CA's from the signing CA to the top-level CA should be present. Multiple certificates are simply appended to the file; the order is not significant.
How else can I accomplish what I am trying to do?