Having the same problem with a fresh install of 6.1. Have tried SBeavers certificate shenanigans but can't get the ID appliance to accept a concatenated pem chain, my certs have 3 layers though (host, SubCA, CA) so wondering if that's causing a problem . Have also tried targeting the GC in AD on port 3268 rather than straight ldap on 389. and have confirmed time is synced across the appliances. have to be missing something in this .....