openlap 2.4 syncrepl with tls - ssl

Question

I have syncrepl all working for the config database and the ldap database, let just concentrate on the ldap database. in this solution we require encryption between consumer and provider in a multi master configuration.
i have this working all well without tls, here is the non tls configuration for syncrepl
olcSyncRepl:
rid=003
provider=ldap://<server1>
binddn="cn=ldapadm,dc=test,dc=local"
bindmethod=simple
credentials=password
searchbase="dc=test,dc=local"
type=refreshOnly
interval=00:00:00:30
retry="5 5 300 5"
timeout=1
olcSyncRepl:
rid=004
provider=ldap://<server2>
binddn="cn=ldapadm,dc=test,dc=local"
bindmethod=simple
credentials=password
searchbase="dc=test,dc=local"
type=refreshOnly
interval=00:00:00:30
retry="5 5 300 5"
timeout=1
updates to server1 updates server2 and updates to server2 updates server1 all good
when trying this replace this configuration with self signed certificates and use ldaps over 636 it fails
this is the ldaps syncrepl config
olcSyncRepl:
rid=003
provider=ldaps://<server1>
binddn="cn=ldapadm,dc=test,dc=local"
bindmethod=simple
credentials=password
searchbase="dc=test,dc=local"
tls_cacert=/etc/openldap/certs/IntInfCA.ca.pem
tls_key=/etc/openldap/certs/serevr1
tls_cert=/etc/openldap/certs/server1.cert
type=refreshOnly
interval=00:00:00:10
retry="5 5 300 5"
timeout=1
olcSyncRepl:
rid=004 provider=ldaps://server2
binddn="cn=ldapadm,dc=test,dc=local"
bindmethod=simple
credentials=password
searchbase="dc=test,dc=local"
tls_cacert=/etc/openldap/certs/IntInfCA.ca.pem
tls_key=/etc/openldap/certs/server2
tls_cert=/etc/openldap/certs/server2.cert
type=refreshOnly
interval=00:00:00:10
retry="5 5 300 5"
timeout=1
this does not work, error messages
Jan 13 08:16:36 hbtc5003 slapd[32321]: slap_client_connect: URI=ldaps://hbtc5503.test.vocalink.co.uk DN="cn=ldapadm,dc=ips,dc=local" ldap_sasl_bind_s failed (-1)
Jan 13 08:16:36 hbtc5003 slapd[32321]: do_syncrepl: rid=004 rc -1 retrying
Jan 13 08:16:36 hbtc5003 slapd[32321]: conn=1001 fd=23 closed (TLS negotiation failure)
Jan 13 08:17:06 hbtc5003 slapd[32321]: conn=1002 fd=23 ACCEPT from IP=10.105.189.178:46550 (IP=0.0.0.0:636)
Jan 13 08:17:06 hbtc5003 slapd[32321]: conn=1002 fd=23 closed (TLS negotiation failure)
any ideas?