I've updated the TLS certificates on cdsldap0, which is the CDS translucent LDAP proxy that provides ligo.org authenticated logins to the control room.  It took longer than expected, because it didn't like the format of the new key file and slapd would die with a "main: TLS init def ctx failed: -207" message.  Running the key file through 'certtool --infile key.pem -k' and using the resulting base64 encoding made it work, apparently gnutls is picky in what it will use for a key, even though it's own tool can read the key as is...