Sorry, see that you already set that, I didn't read enough first.
I would guess AD is saying use TLS. LDAP will say success, cause the query was successful. The result was probably access denied, which is not an error, it's just not what you expected for a result, but the result was a success.
On my setups, I put all the krb5 configuration in krb5.conf. I setup ldap.conf. I use msktutil to join the machine to the domain after being able to successfully kinit username from the machine.
My sssd conf looks basically like this, but substituted your values:
enumerate = false
cache_credentials = true
id_provider = ad
auth_provider = ad
chpass_provider = ad
#access_provider = ad
lookup_family_order = ipv4_first
#dns_discovery_domain =
ds.fs.fed.usldap_uri = ldaps://
ds.fs.fed.us
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/openldap/certs/ad-server-public-cert.pem
ldap_schema = ad
#ldap_id_mapping = False
At some point I really should learn how to put the cert into a cert db thing so I can use the ldap_tls_cacertdir = /etc/openldap/cacerts setting.
Chris