TLS Negotiation issue in OpenLDAP

I have the OpenLDAP Master-Slave architecture. One day I have restarted the slapd service in the LDAP Slave and then found the TLS negotiation issue in the Logs. Before restarting the service, it was working without any issues

Then I tried to debug the issue, I've found some common problem which will trigger TLS negotiation issue.

1. The SSL Certificate might get expired - For my one it's not the case, I've verified that the certificate is valid
2. Certificate CN name mismatch with the server name - In my case, my certificate CN=*.example.com and my server names are ldap.example.com & ldap-slave.example.com.
3. Permission issues in the certificate files - I've 2 directories (certs - [contains certificate & ca cert & key] , cacert - [Only contain cacert]), both of the directories have read and wrtie permission and owned by the LDAP user.

Here is the configuration used by the slapd.

dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/openldap/slapd.args
olcDisallows: bind_anon
olcLogLevel:: YW55IA==
olcPidFile: /var/run/openldap/slapd.pid
olcRequires: authc
olcTLSCACertificateFile: /etc/openldap/certs/example.ca.crt
olcTLSCACertificatePath: /etc/openldap/certs
olcTLSCertificateFile: /etc/openldap/certs/example.crt
olcTLSCertificateKeyFile: /etc/openldap/certs/example.key

dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/lib64/openldap
olcModuleLoad: {0}syncprov.la

dn: cn=module{1},cn=config
objectClass: olcModuleList
cn: module{1}
olcModulePath: /usr/lib64/openldap
olcModuleLoad: {0}auditlog.la

Here is my ldap.conf file

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example,dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT  12
#TIMELIMIT  15
#DEREF      never

#TLS_CACERT /etc/openldap/cacerts/example.ca.crt
#TLS_REQCERT demand
TLS_CACERTDIR /etc/openldap/cacerts
#TLS_CACERT /etc/openldap/certs/example.ca.crt
TLS_REQCERT allow
# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON    on
URI ldaps://ldap.example.com/ ldaps://ldap-slave.example.com/
BASE dc=example,dc=com

So please help me to debug the issue.

Can we have the logs with the error to help you?

Also you do not need both olcCACertificatePath and olcCACertificateFile, for me the configuration with only olcCACertficatePath suffice. I do not know if it is the source of your error but you can try to delete one of them.