Can't use SSL session

["Dan O'Reilly" <dano@process.com>]

Using ldapsearch on a VMS system to attempt to do a directory lookup using 
SSL to a non-OpenLDAP directory on another system.  I verified the root CA 
certificate is correct using:

$ openssl s_client -connect adtest:636 "-CAfile" test_root_ca.pem

My LDAP.CONF file contains:

TLS_CHECKPEER   no
BIND_POLICY     soft
TLS_REQCERT     never
TLS_CACERT      RAPTOR$DKA0:[OREILLY.KEYS]TEST_ROOT_CA.PEM

What happens is below:

$ ldapsearch   "-ZZ" -p 636 -d 255 -s base -x -w xxxxxxxxx -v "-D" 
"cn=Administrator,CN=Users,dc=altdomain2000,dc=psccos,dc=com" 
-b"cn=Users,dc=altdomain2000,dc
=psccos,dc=com" -h adtest.altdomain2000.psccos.com 
"(&(objectclass=user)(sAMAccountName=oreilly))"
ldap_initialize( ldap://adtest.altdomain2000.psccos.com:636 )
ldap_create
ldap_url_parse_ext(ldap://adtest.altdomain2000.psccos.com:636)
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP adtest.altdomain2000.psccos.com:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 192.168.0.27:636
ldap_connect_timeout: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_dump: buf=0x0043ba98 ptr=0x0043ba98 end=0x0043bab7 len=31
  0000:  30 1d 02 01 01 77 18 80  16 31 2e 33 2e 36 2e 31   0....w...1.3.6.1
  0010:  2e 34 2e 31 2e 31 34 36  36 2e 32 30 30 33 37      .4.1.1466.20037
ber_scanf fmt ({) ber:
ber_dump: buf=0x0043ba98 ptr=0x0043ba9d end=0x0043bab7 len=26
  0000:  77 18 80 16 31 2e 33 2e  36 2e 31 2e 34 2e 31 2e   w...1.3.6.1.4.1.
  0010:  31 34 36 36 2e 32 30 30  33 37                     1466.20037
ber_flush: 31 bytes to sd 3
  0000:  30 1d 02 01 01 77 18 80  16 31 2e 33 2e 36 2e 31   0....w...1.3.6.1
  0010:  2e 34 2e 31 2e 31 34 36  36 2e 32 30 30 33 37      .4.1.1466.20037
ldap_write: want=31, written=31
  0000:  30 1d 02 01 01 77 18 80  16 31 2e 33 2e 36 2e 31   0....w...1.3.6.1
  0010:  2e 34 2e 31 2e 31 34 36  36 2e 32 30 30 33 37      .4.1.1466.20037
ldap_result ld 43B028 msgid 1
ldap_chkResponseList ld 43B028 msgid 1 all 1
ldap_chkResponseList returns ld 43B028 NULL
wait4msg ld 43B028 msgid 1 (infinite timeout)
wait4msg continue ld 43B028 msgid 1 all 1
** ld 43B028 Connections:
* host: adtest.altdomain2000.psccos.com  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Thu Oct  5 16:32:20 2006

** ld 43B028 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
** ld 43B028 Response Queue:
   Empty
ldap_chkResponseList ld 43B028 msgid 1 all 1
ldap_chkResponseList returns ld 43B028 NULL
ldap_int_select
read1msg: ld 43B028 msgid 1 all 1
ber_get_next
ldap_read: want=8, got=0

ber_get_next failed.
ldap_perror
ldap_start_tls: Can't contact LDAP server (-1)

Any ideas?  I've been pulling my hair out over this for a couple weeks 
now.  If I do this same search using port 389 and no SSL it works correctly.

------
+-------------------------------+----------------------------------------+
| Dan O'Reilly                  |  "There are 10 types of people in this |
| Principal Engineer            |   world: those who understand binary   |
| Process Software              |   and those who don't."                |
| http://www.process.com        |                                        |
+-------------------------------+----------------------------------------+