IO::Socket::SSL just checks if the certificate is valid at the SSL layer, e.g. that the certificate has a valid signature from a known CA. Interpretation and constrains on the CN of the certificate are specified at the application layer and depend on the protocol used. That's why it is specified in rfc4513 how the CN in the certificate should be checked for LDAP, in rfc2818 for HTTPS etc.

For instance rfc2818 states in 3.1 "If the client has external information as to the expected identity of the server, the hostname check MAY be omitted.".

So this is not an issue which IO::Socket::SSL, it's an issue with Net::LDAPS which should conform to RFC4513. It might do it using the verify_callback of IO::Socket::SSL