Currently if SSL timeout occurs then Errno::ETIMEDOUT will be raised in wrap_with_ssl but later in open_connection it will be caught and created as Net::LDAP::ConnectionError.
But Net::LDAP::ConnectionError will lose all information about it and it can only be caught as Net::LDAP::Error which covers pretty much everything.
So currently to retry temporary issues (ie. timeout) you have to compare Net::LDAP::Error message with "Connection timed out - OpenSSL connection read timeout" for this.
I think Net::LDAP::ConnectionError should do same for Errno::ETIMEDOUT as it does for Errno::ECONNREFUSED