The server fails to remove user certificate because it's trying to remove the certificate subject DN from the seeAlso attribute that doesn't exist in the user entry.

Generally user entries will not have a subject DN in the seeAlso attribute except for a special DB user entry. However, in UGSubsystem.removeUserCert() the code will always try to remove the
attribute value:

LDAPAttribute certDNAttrS = new LDAPAttribute(LDAP_ATTR_CERTDN);
...                    certDNAttrS.addValue(certs[i].getSubjectDN().toString());
...
attrs.add(LDAPModification.DELETE, certDNAttrS);
...
ldapconn.modify("uid=" + user.getUserID() + "," +
    getUserBaseDN(), attrs);

If the attribute (seeAlso) or the value (subject DN) doesn't exist it will throw an LDAP error code 16 (no such attribute).

One solution is to check first whether the user entry has the subject DN in the seeAlso attribute then only remove it if it exists.