Mail server sending to postfix refusing TLS connection with "certificate expired", but it's not

[9peppe]

I'm talking about this option:

@PMc

the key is the key, the cert is the cert, and the cacert.pem is the chain, i.e. the collection of intermediate certificates that are needed for the adversary to get to one of their known root ca certs, which obviousely must be sent to the adversary during handshake.

But here the doc talks about something different: it appears to say that the cacert.pem contains a "list of acceptable CAs".

"List of acceptable CAs" can mean "a root store" instead of "the certificate chain."