$ openssl s_client -starttls smtp -crlf -ssl3 -connect mail.arcor.de:587
CONNECTED(00000003)
depth=2 C = US, O = "thawte, Inc.", OU = Certification Services Division, OU = "(c) 2006 thawte, Inc. - For authorized use only", CN = thawte Primary Root CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=DE/ST=NRW/L=Duesseldorf/O=Vodafone D2 GmbH/CN=mail.arcor.de
   i:/C=US/O=Thawte, Inc./CN=Thawte SSL CA
 1 s:/C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA
   i:/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
 2 s:/C=US/O=Thawte, Inc./CN=Thawte SSL CA
   i:/C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDyzCCArOgAwIBAgIQfYPS3H0iHoTaB15/ucRgYDANBgkqhkiG9w0BAQUFADA8
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMVGhhd3RlLCBJbmMuMRYwFAYDVQQDEw1U
aGF3dGUgU1NMIENBMB4XDTExMDkyNjAwMDAwMFoXDTE1MDkyNTIzNTk1OVowZDEL
MAkGA1UEBhMCREUxDDAKBgNVBAgTA05SVzEUMBIGA1UEBxQLRHVlc3NlbGRvcmYx
GTAXBgNVBAoUEFZvZGFmb25lIEQyIEdtYkgxFjAUBgNVBAMUDW1haWwuYXJjb3Iu
ZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCbmlcHNLvU6u/3VivH
4vQZdGelrsUtFiF11GuoHIdntNh9L1OOu1q02rL9u+/ypL5KNFmqrgWSX9hVuAJ5
4ZmM07xiztFEouDMdSgHi22FZzKS4gOEualPntGOyLP+81kQrp096QlDWNFwNLlO
v7u1IEB+q0p6k5dy8bnkkVT4LW65AQiZvKKIci58lC/MlnWn4sSpNV0xcrdrkCRq
Xz14LirEEA/Mn3cZdVAzrW7Vw6FhvON6PifARVSBuPJxuYbk9/sqwYihqQZJFIhG
VCVuYRottlUmAuJl1yq1B+rGHhKSR0Z26UuNgkC7QABacNJBXAkEPeV6Ee6yEGYf
u4CdAgMBAAGjgaAwgZ0wDAYDVR0TAQH/BAIwADA6BgNVHR8EMzAxMC+gLaArhilo
dHRwOi8vc3ZyLW92LWNybC50aGF3dGUuY29tL1RoYXd0ZU9WLmNybDAdBgNVHSUE
FjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUF
BzABhhZodHRwOi8vb2NzcC50aGF3dGUuY29tMA0GCSqGSIb3DQEBBQUAA4IBAQAa
xL0BywVimRCF2wcbZpueY8NBUSp2Xj02tI2RqPUuu6D/MZGFAHMsfcNlAyslaotb
VuEwDMxTD9EXSeDw98EnukMCoOlR0+pu6Wf0LxFnYBdUTvY+t0lDn0UxZBNzzy/0
NThfkV3BmzKnJ2YqUYoZJ4dTjoF3HW+QYqfAeT/n2LqLFudC0m+8lIQX3g3xgoup
8u5FMLflKQDnUZDYV2MgWDX1QAbU9RTJhzQe+m0lwL2kV0gcRGq4wiYKPPXGUPPl
yXJoC3VM6Ya9mkrJDLxLPDZBfnkc4+o5ro6zfvWaloz5R6r3ib3sJOdvXKjUs9Vf
Cr3eYYnu14l/tEwCOE0e
-----END CERTIFICATE-----
subject=/C=DE/ST=NRW/L=Duesseldorf/O=Vodafone D2 GmbH/CN=mail.arcor.de
issuer=/C=US/O=Thawte, Inc./CN=Thawte SSL CA
---
No client certificate CA names sent
---
SSL handshake has read 4213 bytes and written 387 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 878C40D1E1FA41290FCC24A57AC10DA815F9DACFCA88E8DD9368E99DABFB1C1E
    Session-ID-ctx: 
    Master-Key: 106687C396B13183F9410DDA36CC95737986AC1749F8F68D6CE23C92BEFBC3B3EC920DC0151FD2B90397B18D9803357C
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1413452885
    Timeout   : 7200 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---
250 DSN