I had base set to Accounts OU in nslcd so I can now enumerate groups by setting base correctly :) However I still do see this issue in sssd_LDAP log:
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sdap_uri_callback] (0x0400): Constructed uri 'blah'
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sss_ldap_init_send] (0x4000): Using file descriptor [21] for LDAP connection.
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sss_ldap_init_send] (0x0400): Setting 30 seconds timeout for connecting
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sss_ldap_init_sys_connect_done] (0x0020): ldap_install_tls failed: Connect error
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sss_ldap_init_state_destructor] (0x0400): calling ldap_unbind_ext for ldap:[0x20333d0] sd:[21]
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sdap_sys_connect_done] (0x0020): sdap_async_connect_call request failed: [5]: Input/output error.
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [sdap_handle_release] (0x2000): Trace: sh[0x202c170], connected[0], ops[(nil)], ldap[(nil)], destructor_lock[0], release_memory[0]
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [_be_fo_set_port_status] (0x8000): Setting status: PORT_NOT_WORKING. Called from: src/providers/ldap/sdap_async_connection.c: sdap_cli_connect_done: 1564
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0100): Marking port 636 of server 'blah' as 'not working'
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [fo_set_port_status] (0x0400): Marking port 636 of duplicate server 'blah as 'not working'
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP'
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [get_server_status] (0x1000): Status of server 'blah is 'name resolved'
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [get_port_status] (0x1000): Port status of port 636 for server 'blah' is 'not working'
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [fo_resolve_service_send] (0x0020): No available servers for service 'LDAP'
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [be_resolve_server_done] (0x1000): Server resolution failed: 5
(Fri Aug 12 11:28:26 2016) [sssd[be[LDAP]]] [check_online_callback] (0x0100): Backend returned: (1, 0, <NULL>) [Provider is Offline]
LDAPTLS_REQCERT=never ldapsearch -Z -x uid=blah works...
ldap_create
ldap_extended_operation_s
ldap_extended_operation
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP blah:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying blah:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
attempting to connect:
connect success
tls_write: want=137, written=137
ldapsearch - ZZ debug shows the certificate has expired thus is not trusted.