I have /etc/openldap/ldap.conf TLS_CACERTDIR /etc/openldap/cacerts SASL_NOCANON on URI ldaps://dcdc0011.domain.local:636 ldaps://dcdc0021.domain.local:636 SCOPE one BASE dc=domain,dc=local REFERRALS off Freeradius ldap tells TLS: hostname (DomainDnsZones.domain.local) does not match common name in certificate (dcdc0020.domain.local). TLS: can't connect: TLS: hostname does not match CN in peer certificate. Unable to chase referral "ldaps://DomainDnsZones.domain.local/DC=DomainDnsZones,DC=domain,DC=loc al" (-1: Can't contact LDAP server) TLS: hostname (ForestDnsZones.domain.local) does not match common name in certificate (dcdc0020.domain.local). TLS: can't connect: TLS: hostname does not match CN in peer certificate. Unable to chase referral "ldaps://ForestDnsZones.domain.local/DC=ForestDnsZones,DC=domain,DC=loc al" (-1: Can't contact LDAP server) TLS: hostname (domain.local) does not match common name in certificate (dcdc0011.domain.local). TLS: can't connect: TLS: hostname does not match CN in peer certificate. Unable to chase referral "ldaps://domain.local/CN=Configuration,DC=domain,DC=local" (-1: Can't contact LDAP server) Why is REFERRALS off not taken into account - or how can these chase-referrals being disabled? Thanks for your help in advance T