I'm using self signed certs, did I miss something?
Probably.  There are many steps involved in getting winsync to use TLS/SSL to talk to AD, and getting AD PassSync to use TLS/SSL to talk to DS.  Which
 
 
From the Docs listed online: http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.1/html/Administration_Guide/Windows_Sync-Configuring_Windows_Sync.html

and I went over everything else I could possibly find too.  It seems in the case of self signed certificates, the windows CA has to exported as a .cer file, and imported in 389 with:  certutil -d . -A -n "AD Cert" -t "CTu,u,u" -i ad-cert.cer