machines:

1. debian wheezy
2. suse 11

commands:

1. `ldapsearch -ZZ -h ad.unsw.edu.au -x`
2. `perl -we "use Net::LDAP; print Net::LDAP->new ('ad.unsw.edu.au')->start_tls(verify => 'require', capath => '/etc/ssl/certs/')->{errorMessage}"`

results:

* machine 1, command 1: TLS: hostname does not match CN in peer certificate
* machine 1, command 2: works
* machine 2, command 1: works
* machine 2, command 2: Cannot determine peer hostname for verification

i can't explain the inconsistency and i really want command 2 to work on machine 2. any ideas?

after an strace, it looks like debian-ldapsearch is looking at `/etc/ssl/certs/ca-certificates.crt` and suse-ldapsearch is looking at NOTHING. debian-`Net::LDAP` is looking at `/etc/ssl/certs/157753a5.?` (`AddTrust_External_Root.pem`) and suse-`Net::LDAP` is looking at NOTHING.