> The fact that RH builds use MozNSS instead of OpenSSL, a constant source of low-level friction and intermittent breakage, doesn't help matters. (Likewise, Deb

> The fact that RH builds use MozNSS instead of OpenSSL, a constant source of low-level friction and intermittent breakage, doesn't help matters. (Likewise, Debian builds OpenLDAP with GnuTLS.) But, IIRC, the Debian developers did some work on addressing the gaps, whereas the RH/moznss guys just put their fingers in their ears and said "nobody needs well-performing SSL handling in a server context like OpenSSL provides", and all of their contributions focused purely on the OpenLDAP client-side. For a long time, I provided builds of OpenLDAP for RHEL3/4/5, and finally on RHEL7 RH's packages were recent enough and didn't have too many mozNSS-related problems to be usable out-the-box in our large OpenLDAP deployment. I'll have to give the guys who are still there a heads-up and consider reviving my RPM rebuilds for RHEL.