使用python-ldap验证Google LDAP凭证时遇TLS证书信任问题求助

我正在开发Python项目，需要用python-ldap库验证从Google Admin Console获取的证书、私钥和域名，目标是确认这些凭证的正确性。

我编写了以下代码：

import ldap
ldap.set_option(ldap.OPT_DEBUG_LEVEL, 255)
from ldap.filter import filter_format

def validate_google_ldap_credentials():
    cert_pem = "-----BEGIN CERTIFICATE-----MIIDbDCCAlSgAwIBAgIGAYrS3Ls6MA0GCSqGSIb3DQEBCwUAMHcxFDASBgNVBAoTC0dvb2dsZS ... -----END CERTIFICATE-----"
    key_pem = "-----BEGIN PRIVATE KEY-----MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDgtywlWAKTNFkA7nE+hWBLbhUPJjC2KIGxT0tFcU ... -----END PRIVATE KEY-----"
    ldap_url = "ldaps://ldap.google.com:636"
    ldap_conn = ldap.initialize(ldap_url)
    ldap_conn.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_ALLOW)
    ldap_conn.set_option(ldap.OPT_X_TLS_CERTFILE, cert_pem)
    ldap_conn.set_option(ldap.OPT_X_TLS_KEYFILE, key_pem)
   
    try:
        ldap_conn.search_s("dc=zta-emumba,dc=com", ldap.SCOPE_SUBTREE, '(mail=abc@example.com)')
    except ldap.LDAPError as e:
        print("LDAP search failed:", e)

连接过程中遇到TLS相关问题，错误提示对等证书不受信任或已吊销，LDAP日志如下：

ldap_create
ldap_url_parse_ext(ldaps://ldap.google.com:636)
ldap_search_ext
put_filter: "(mail=abc@example.com)"
put_filter: simple
put_simple_filter: "mail=abc@example.com"
ldap_build_search_req ATTRS: *
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP ldap.google.com:636
ldap_new_socket: 10
ldap_prepare_socket: 10
ldap_connect_to_host: Trying 216.239.32.58:636
ldap_pvt_connect: fd: 10 tm: -1 async: 0
attempting to connect: 
connect success
TLS: peer cert untrusted or revoked (0x42)
TLS: can't connect: (unknown error code).
ldap_err2string
LDAP search failed: {'result': -1, 'desc': "Can't contact LDAP server", 'errno': 101, 'ctrls': [], 'info': '(unknown error code)'}

求指导：我哪里出错了？如何用python-ldap或其他Python库正确验证这些Google LDAP凭证？

内容的提问来源于stack exchange，提问作者Mahnoor Iqbal