Thanks for the quick response.
I replaced fullchain.pem on the chain.pem, but SLAPD still does not start.
In the logs there is a mention apparrmor. Perhaps now the reason is apparmor.
Now I have no way to check. Tomorrow morning I'll try.

It worked for me!
If necessary, I am prepared to write what and where is further configured on the server to achieve a result.

Having fun doing it!

Configuring access to global address book via the encrypted channel.
The source data:
- iRedMail version: 0.9.5.-1
- OS: Ubuntu 14.04
- Store mail accounts in which backend: LDAP
- Web server: Nginx
- Issuing the SSL certificate: Let's Encrypt

Task to configure access to the LDAP directory using SSL.

1. Make changes to the LDAP configuration file.
Instead of self-signed certificates iRedMail writing received from Let's Encrypt.

$ sudo vim /etc/ldap/slapd.conf

TLSCACertificateFile /etc/letsencrypt/live/mail.MYDOMAIN.LTD/chain.pem
TLSCertificateFile /etc/letsencrypt/live/mail.MYDOMAIN.LTD/cert.pem
TLSCertificateKeyFile /etc/letsencrypt/live/mail.MYDOMAIN.LTD/privkey.pem

Don't forget to replace MAIL.MYDOAMIN.LTD to your domain

Ubuntu uses Apparmor, which blocks the new path to the certificates.
In the result of ldap when you restart doesn't start.
I translated slapd from enforce mode to complain mode.

$ sudo aa-complain /etc/apparmor.d/usr.sbin.slapd

Now need to fix the file /etc/default/slapd by citing the following line to this:

SLAPD_SERVICES="ldap:/// ldapi:/// ldaps:///"

Now need to restart slapd

$ sudo service slapd restart

Then edited file /etc/default/iptables and remove the comment from following lines

-A INPUT -p tcp --dport 636 -j ACCEPT

Now need to restart iptables

$ sudo service iptables restart

Check from another host that ldaps is now available outside

imak@lucifer:~$ nmap mail.maydomain.ltd
......
Not shown: 991 filtered ports
PORT     STATE  SERVICE
25/tcp   open   smtp
80/tcp   open   http
143/tcp  open   imap
389/tcp  open   ldap
443/tcp  open   https
587/tcp  open   submission
636/tcp  open   ldapssl
993/tcp  open   imaps
3306/tcp closed mysql

Nmap done: 1 IP address (1 host up) scanned in 4.77 seconds

It is now possible to configure Thunderbird to connect to the global address book using 636 port.

Sorry again for my English.
And correct me if there are errors in the design.
This is my first experience.

I just don't know how to do it correctly
This will be the next step

Could you maybe explain it in detail howto secure outgoing connections using STARTTLS?

I've meant the connection from another machine to the OpenLDAP. How can I ensure that these connections are encrypted by STARTTLS?

I've done so:

but in my case OpenLDAP is logging into syslog (iRedMail 0.8.7) and I've got the following:

Oct 10 14:16:41 example slapd[16787]: conn=1003 op=0 BIND dn="cn=Manager,dc=example,dc=com" method=128
Oct 10 14:16:41 example slapd[16787]: conn=1003 op=0 BIND dn="cn=Manager,dc=example,dc=com" mech=SIMPLE ssf=0
Oct 10 14:16:41 example slapd[16787]: conn=1003 op=0 RESULT tag=97 err=0 text=

Am I right that this means that the connection is unencrypted? How should it look if it is encrypted? And what can I do to activate encryption.

If I'm trying to force STARTTLS by using this command:

 ldapwhoami -H ldap://example.com -x -ZZ

I get the follwing error message:

ldap_start_tls: Connect error (-11)
    additional info: (unknown error code)

Here is my SSL configuration in

/etc/ldap/slapd.conf

# TLS files.
TLSCACertificateFile /etc/ssl/certs/iRedMail_CA.pem
TLSCertificateFile /etc/ssl/certs/iRedMail_CA.pem
TLSCertificateKeyFile /etc/ssl/private/iRedMail.key

Access over port 636 seems not to work (but it is opened in the iptables):

ldapwhoami -H ldaps://example.com -x
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

I already had this setting and port 636 is open. Here are my results given by nmap:

Host is up (0.050s latency).
Not shown: 986 filtered ports
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
80/tcp   open  http
110/tcp  open  pop3
143/tcp  open  imap
389/tcp  open  ldap
443/tcp  open  https
587/tcp  open  submission
636/tcp  open  ldapssl
993/tcp  open  imaps
995/tcp  open  pop3s
5222/tcp open  xmpp-client
5269/tcp open  xmpp-server
5280/tcp open  xmpp-bosh

But I can't connect via SSL/port 636. A ldapsearch with the -h option

 ldapsearch -h ldaps://example.com ....

gives me this error message:

Could not create LDAP session handle for URI=ldap://ldaps:%2F%2Fexample.com (-9): Bad parameter to an ldap routine

Did you try the ldapsearch command on mail server or another server? If it's on mail server, try 'ldaps://127.0.0.1:636' as server address.

OK, try ldapsearch with flag '-d 256', it will print debug message on console.

When i try it on (testing) mail server:

So i replace '127.0.0.1' by the server hostname ('ldaps://d8.iredmail.org:636'), and it works: