SSL_ALLOW_SELFSIGNED={
N|Y}

N
.
Uses certificates from a commercial certificate authority (CA) that the system trusts.
Y.
Uses self-signed certificates. Self-signed certificates are not verifiable by following the chain to a trusted certificate authority. Self-signed certificates are for internal use only, such as for connections within your organization's network or for internal testing.
If you specify SSL_ALLOW_SELFSIGNED=Y with OPENLDAP credentials checking and also specify the LDAP_TLS statement with the START_TLS=Y parameter, self-signed certificates from the LDAP server are tolerated and credentials checking proceeds.

Configure the SSL_ALLOW_SELFSIGNED, SSL_CIPHER_LIST, or SSL_CONTEXT_METHOD statement only if a failure connecting to the LDAP server occurs.
On Windows, setting the trace filter TRACE=(SEC,9,99) causes low-level tracing in the Open LDAP client libraries, which can provide information about whether the connection to the LDAP server failed because of correctable errors such as self-signed certificates, no ciphers shared between the client and server, or context method mismatches between the client and server.
Informatica recommends using the strongest TLS protocol supported on both the client and server systems. OpenLDAP libraries 2.5.18 support TLS protocol TLSV1_3. If the LDAP server does not support TLS protocol TLSV1_3, configure the SSL_CONTEXT_METHOD statement in the Windows dbmover.cfg to specify the strongest TLS protocol supported by the LDAP server, for example, SSL_CONTEXT_METHOD=TLSv1_2.