@cstamas actually 'com.sun.jndi.ldap.connect.pool' is an LDAP context "environment" property - not a system property. 

It is set (here)[https://github.com/sonatype/nexus/blob/master/plugins/ldap/ldap-common/src/main/java/org/sonatype/security/ldap/realms/DefaultLdapContextFactory.java#L279].

It is read (when making a connection)[http://grepcode.com/file/repository.grepcode.com/java/root/jdk/openjdk/6-b14/com/sun/jndi/ldap/LdapCtx.java#189].

I think this means we should remove the setting of this property in wrapper.conf.

----

Issue NXCM-5067 is about SSL ldap connections not being pooled. The protocol selection is determined in a static block by (LdapPoolManager.java)[http://grepcode.com/file/repository.grepcode.com/java/root/jdk/openjdk/6-b14/com/sun/jndi/ldap/LdapPoolManager.java#148] reading the *system* property 'com.sun.jndi.ldap.connect.pool.protocol' as you have stated. Therefore

> wrapper.java.additional.3=-Dcom.sun.jndi.ldap.connect.pool.protocol=plain ssl

should be changed to 

> wrapper.java.additional.2=-Dcom.sun.jndi.ldap.connect.pool.protocol=plain ssl

after removing 

> wrapper.java.additional.2=-Dcom.sun.jndi.ldap.connect.pool=true