Somewhere between 6.2 and 6.5 the LDAP realm behaviour changed to not reload the SSL context if the underlying file contents change (updated CA file).

The SSL Service still reloads the internal context, but the LDAP realm doesn't use it.

My guess is that this might be due to the way we changed reloading to support FIPS, but I haven't dug into it yet.