For your case of wanting TLS with what looks like the system cert store, you can set this in the 4th parameter with

{encryption => {method => simple_tls}

(or set the same via $confdir/ldapquery.yaml