You have, of course, set up TLS via ?letsencrypt for or the server itself, so we already have a TLS certificate for the hostnames FQDN, which we will use for the slapd service.

Only root has access to the certificates, so we make copies into /etc/ldap/ssl, which are updated, every time certbot renews them.

Requirements

Directory setup

?shnippet:

sudo -i

# Create /etc/ldap/ssl
install -d -m 2750 -o root -g openldap /etc/ldap/ssl

# Create Makefile for certificate maintenance
cd /etc/ldap/ssl  || cat >&2
sed -n 's/^  */\t/;wMakefile' <<EOF
# $SUDO_USER $(date -uIs)
#
# Create ldap TLS certificate files
# Fix file permissions
# Update them from hosts letsencrypt certificate files

all: cert.pem fullchain.pem privkey.pem 

%.pem: /etc/letsencrypt/live/\$(shell hostname -f)/%.pem
    touch \$@
    chown root:openldap \$@
    chmod 640 \$@
    cat \$^ > \$@
EOF

# Create update script for certbot
cat > update-certs <<EOF
#!/bin/sh
# $SUDO_USER $(date -uIs)

EOF
cat >> update-certs <<'EOF'
if [ x"$RENEWED_LINEAGE" != x ] && \
   [ x"$RENEWED_LINEAGE" != x/etc/letsencrypt/live/"$(hostname -f)" ]; then
    echo ldap update-certs: not me: $(hostname -f) ne $RENEWED_LINEAGE >&2
    exit
fi

set -e
cd /etc/ldap/ssl

make -qr && { echo slapd certs are up to date >&2; exit; }
make -r

service slapd restart
EOF

make

Renew Hook in certbot cron job

See: certbot

sudo true

cd /etc/cron.weekly || cat >&2
sudo sed -i '/# last line/i\    --renew-hook /etc/ldap/ssl/update-certs \\' certbot

Configure slapd to use the certificates

Open the cn=config LDAP tree as LDIF file in your default editor with:

ldapvi -Y EXTERNAL -b cn=config

Append the following lines to the cn=config entry.

olcTLSCACertificateFile: /etc/ldap/ssl/fullchain.pem
olcTLSCertificateFile: /etc/ldap/ssl/cert.pem
olcTLSCertificateKeyFile: /etc/ldap/ssl/privkey.pem
olcTLSVerifyClient: allow

Disable insecure access

As root edit /etc/default/slapd, so that SLAPD_SERVICES read:

SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"
# SLAPD_SERVICES="ldap:/// ldapi:///"
# SLAPD_SERVICES="ldaps:/// ldapi:///"

Then service slapd restart