update default cacert

roles/openLdapClient/defaults/main.yml

@@ -8,5 +8,7 @@ ldapUserHomeDirectory: "unixHomeDirectory"
 ldapUserPricipal: "userPrincipalName"
 ldapGroupBase: "ou=groups,dc=monash,dc=edu,dc=au"
 tlsCaCertDirectory: "/etc/openldap/certs"
-tlsCaCertFile: "ca.pem"
+tlsCaCertFile: "/etc/openldap/certs/ca.pem"
 ldapCaCertFileSource: "/etc/openldap"
+cacertFile: "ca.pem"
+

roles/openLdapClient/templates/sssd.j2

@@ -27,7 +27,9 @@ access_provider = ldap
 
 ldap_uri = {{ ldapUri }} 
 ldap_id_use_start_tls = True
-ldap_tls_reqcert = demand 
+ldap_tls_reqcert = allow 
+ldap_tls_cacertdir = {{ tlsCaCertDirectory }} 
+ldap_tls_cacert = {{ cacertFile }}
 ldap_default_bind_dn = {{ ldapDn }} 
 ldap_default_authtok_type = password
 ldap_default_authtok = {{ ldapPassword }}