# ipa-replica-manage connect --winsync --passsync=password --cacert=/home/mkosek/wincertnew.cer dhcp201-112.englab.pnq.redhat.com --binddn "cn=Administrator,cn=Users,dc=englab,dc=pnq,dc=redhat,dc=com" --bindpw Secret123 -v -p kokos123
Added CA certificate /home/mkosek/wincertnew.cer to certificate database for vm-068.idm.lab.bos.redhat.com
ipa: INFO: Failed to connect to AD server dhcp201-112.englab.pnq.redhat.com
ipa: INFO: The error was: {'info': "TLS error -8179:Peer's Certificate issuer is not recognized.", 'desc': 'Connect error'}
Failed to setup winsync replication

The way openldap TLS initialization works in openldap-2.4.26-6 and later is
this:

When you have an LDAP *ld or an ldap handle created by ldap.initialize, and you
call ldap_set_option to set options in this handle, they are stored in the
options area of the handle, but not in the TLS options area of the handle,
until you call set_option(ldap.OPT_X_TLS_NEWCTX, 0).  This causes the creation
of the new TLS context and writes the saved TLS option settings into the new
TLS context.  If you then attempt to set another TLS option in the same ldap
handle, the changes will again be stored in the ldap option area, but not in
the TLS context.