Hi Andy,

in case you are using a "typical" iManager setup, I suppose the "bind destination" depends on the information provided during login. E.g

From what I know, you can either define the tree name (in this case iManager will try to connect to the "preferred" eDir host, probably the one running on the same box as the iManager you adress in the URL but I am not 100% sure).

If you want to bind to a specific replica, you can either enter IP OR FQDN of that specific eDirectory host you want to bind to. In case you are using custom ports (some other than the 524 default port) you can also enter it via [address]:[port].

In case of secure LDAPS connections:

It depends which certificate is being using to secure the LDAP connection to you LDAP server(s). Have a look here.

https://www.netiq.com/documentation/imanager/imanager_admin/data/bx8g5g8.html

Best regards,
Philipp

Yes, part of the issue was having the tree name in that field that says 'Tree' if there is nothing in it.  Changing to the IP of the server fixed it over the weekend, which confirms what you posted

why it couldn't just try its own local LDAP instance...    sigh

So if you want to have Universal Password work without the NMAS errors, you either need to have the host SSL certs that your <tree>.domain.local point to be created with that tree name in the SAN,  or don't use the tree name in there.    blah, ugly or non-resilient.  

cool cert bits for tomcat/java in that link,  thank you, and thank you for your assistance.