It looks like my problem was that with LDAP-UX you can only use TLS over an
unencrypted port. If you try to use it over 636 it fails. I guess this is
normal. Thanks for the help.
What, exactly, were you trying to do? Port 636 is the "ldaps" port, i.e.,
negotiate-SSL-on-connect, so you have to change the URI schema to use it.
If you were trying to do use a URI like "ldap://hostname:636";, then try
again with "ldaps://hostname" (636 is the default port for the ldaps
schema).