The tls allow option will cause problems when no ldap.conf is defined on the client system. If the certificate option fails, warn and keep going.