You don't need X on the 389 server.
The LDIF below is based on this document [1] and what I have in my SSL/TLS enabled 389 server.
dn: cn=config
changetype: modify
replace: nsslapd-secureport
nsslapd-secureport: 636
-
replace: nssldap-security
nssldap-security: on
-
replace: nsslapd-ssl-check-hostname
nsslapd-ssl-check-hostname: off
dn: cn=encryption,cn=config
changetype: modify
replace: nsSSL3
nsSSL3: on
-
replace: nsSSL3Ciphers
nsSSL3Ciphers: -rsa_null_md5,-rsa_null_sha,+rsa_rc4_128_md5,+rsa_rc4_40_md5,
+rsa_rc2_40_md5,+rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des
_sha,+fortezza,+fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_wit
h_rc4_56_sha,+tls_rsa_export1024_with_des_cbc_sha,+tls_rsa_aes_128_sha,+tls
_rsa_aes_256_sha
-
replace: nsSSLClientAuth
nsSSLClientAuth: allowed
I run these LDIFs using Apache Directory Studio, but the same file should work using examples from [1].