syncrepl inherits default TLS settings from main slapd config

diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5
index b22ba1bf754a9d7a04e345bc7cb0891c6ac9c7c3..f0dbc1fea23dead09e612c7050ced19b7c5ec238 100644 (file)
--- a/doc/man/man5/slapd-config.5
+++ b/doc/man/man5/slapd-config.5
@@ -1781,11 +1781,9 @@ parameter specifies use of the StartTLS extended operation
 to establish a TLS session before Binding to the provider. If the
 .B critical
 argument is supplied, the session will be aborted if the StartTLS request
-fails. Otherwise the syncrepl session continues without TLS.  Note that the
-main slapd TLS settings are not used by the syncrepl engine;
-by default the TLS parameters from ETCDIR/ldap.conf will be used.
-TLS settings may be specified here, in which case the ldap.conf settings
-will be completely ignored.
+fails. Otherwise the syncrepl session continues without TLS. The
+tls_reqcert setting defaults to "demand" and the other TLS settings
+default to the same as the main slapd TLS settings.
 
 Rather than replicating whole entries, the consumer can query logs of
 data modifications. This mode of operation is referred to as \fIdelta

diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5
index 776a07c8c714280bf26f3280f4678a538a8be7cf..4db7b1c1b75f936af86fc6d23764a69776ac4fb2 100644 (file)
--- a/doc/man/man5/slapd.conf.5
+++ b/doc/man/man5/slapd.conf.5
@@ -1689,11 +1689,9 @@ parameter specifies use of the StartTLS extended operation
 to establish a TLS session before Binding to the provider. If the
 .B critical
 argument is supplied, the session will be aborted if the StartTLS request
-fails. Otherwise the syncrepl session continues without TLS.  Note that the
-main slapd TLS settings are not used by the syncrepl engine;
-by default the TLS parameters from ETCDIR/ldap.conf will be used.
-TLS settings may be specified here, in which case the ldap.conf settings
-will be completely ignored.
+fails. Otherwise the syncrepl session continues without TLS. The
+tls_reqcert setting defaults to "demand" and the other TLS settings
+default to the same as the main slapd TLS settings.
 
 Rather than replicating whole entries, the consumer can query logs of
 data modifications. This mode of operation is referred to as \fIdelta