I tried changing it to “server-cert”, did not help.I'm not sure what is wrong/mismatched as it's failing inside of the openldap client library. I wonder if the cert nickname having the "CN=" in it is a problem? It shouldn't be, but who knows.
openldap just describes the flag as:
LDAPSSL_AUTH_CNCHECK
indicates that you accept the server's certificate only if you trust the CA who issued the certificate and if the value of the cn attribute is the DNS hostname of the server.
Under cn=config what is nsslapd-localhost set to? Is it the correct FQDN?
What is in /etc/openldap/ldap.conf?
There are no messages containing "conn_connect”?