This is probably something to kick upstream.

Serverside: slapd 2.4.7-3 with TLS (not ldaps) enabled.  It's running on a VM with a hostname of 'utilserver.domain.org', and its SSL cert has a CN of 'utilserver', since usually only internal users interact with it.

$ /usr/lib/nagios/plugins/check_ldap -T -H utilserver -b `grep BASE /etc/ldap/ldap.conf| awk '{print $2}'`
LDAP OK - 0.041 seconds response time|time=0.040605s;;;0.000000
$ host utilserver
utilserver.domain.org has address 192.168.20.20
$ /usr/lib/nagios/plugins/check_ldap -T -H 192.168.20.20 -b `grep BASE /etc/ldap/ldap.conf| awk '{print $2}'`

Could not init startTLS at port 389!

$ /usr/lib/nagios/plugins/check_ldap -T -H utilserver.domain.org -b `grep BASE /etc/ldap/ldap.conf| awk '{print $2}'`

Could not init startTLS at port 389!


It appears (though I haven't confirmed since my C-fu is weak) that the -T flag co-opts the hostname as specified in the -H and uses that in its TLS handshake.  But that overload is not always good: my nagios checks, which use the FQDN, fail.

Suggestion:
-T is currently a boolean flag.  How about -T [optional hostname for certificate handshake if -H isn't good enough]?  I can't think of anything else you might want after -T, myself.

Thanks!

tag 463355 + wontfix
thanks
[...]

the upstream bug got no comment while it is more than 9 months open there.
I'm tagging the bug wontfix, upstream bug will be keeped open from my side.

With kind regards, Jan.

Good Day,

Please accept my apologies for writing you a surprise letter.I am
Mr.Ahmed Owain, account Manager with an investment bank here in
Burkina Faso.I have a very important business I want to discuss with
you.There is a draft account opened in my firm by a long-time client
of our bank.I have the opportunity of transferring the left over fund
(15.8 Million UsDollars)Fiftheen Million Eight Hundred Thousand United
States of American Dollars of one of my Bank clients who died at the
collapsing of the world trade center at the United States on September
11th 2001.

I want to invest this funds and introduce you to our bank for this
deal.All I require is your honest co-operation and I guarantee you
that this will be executed under a legitimate arrangement that will
protect us from any breach of the law.I agree that 40% of this money
will be for you as my foreign partner,50% for me while 10% is for
establishing of foundation for the less privilleges in your country.If
you are really interested in my proposal further details of the
Transfer will be forwarded unto you as soon as I receive your
willingness mail for a successful transfer.

Yours Sincerely,
Mr.Ahmed Owain,