While configuring our web filter, we realized that Apple’s default master/slave setup only allows LDAPS through the master server. This has some major limitations in regards to the usefulness of replicas. It turns out that one simple terminal command solves the problem.

sudo slapconfig -setldapconfig -ssl on -sslcert /etc/certificate/<your certificate>.crt -sslkey /etc/certificate/<your certificate>.key -ssldomain <server domain>

If there’s a way to do this through the GUI I couldn’t find it. Hope this helps somebody else out there.