This is all great feedback. Thanks everyone. I'm trying to figure out how to grab a copy of the SEGFAULT core for SSSD which I will provide as an attachment back to this conversation when I figure out how to extract it.
I noticed that providers/ldap/ldap_common.c:855 automatically uses SSS_LDAP_SRV_NAME to construct the LDAP uri on discovery which is statically set (providers/ldap/ldap_common.h:36) to "ldap" and is very problematic if ldap is supposed to be ldaps in the uri.
Why this combination might lead to a SEGFAULT is still a bit of a mystery to me so I'll try to find the additional troubleshooting information.
As pointed out to me in a couple of the other responses TLS and not SSL is probably the better way to go which is surprising to me but admittedly I am new to the LDAP security world and that will give me something to research more deeply. Does SSSD cater more to the TLS + LDAP combination?
My hope was to see how far I could get with a fairly secure Kerberos + LDAP combination that could (mostly) automatically be pushed to the clients (SSSD) with as little configuration as possible. Initially LDAPS seemed to make sense and SRV records for DNS Discovery also seemed like a decent choice.