As per WP 11871 I updated the x509 certificates for the local ldap servers.  This is regular maintenance and should not have been noticed by any users.

I updated the secondary system first and found some puppet issues that I fixed before updating the other servers.  This mainly involved putting the CA certificate chain in the certificate file for the slapd process.