Googled and found something.
export LDAPTLS_CACERTDIR=/etc/pki/pki-tomcat/alias
export LDAPTLS_CERT='subsystemCert cert-pki-ca'
ldapsearch -H ldaps://`hostname`:636 -b "" -s base -Y EXTERNAL -Q -LLL dn
namingcontexts
------------
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
additional info: TLS error -12195:Peer does not recognize and trust the CA that
issued your certificate.
What ooes it mean?