$ openssl s_client -starttls smtp -crlf -ssl3 -connect mx-ha02.web.de:25
CONNECTED(00000003)
depth=2 C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN = Deutsche Telekom Root CA 2
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
 0 s:/C=DE/O=1&1 Mail & Media GmbH/ST=Rhineland-Palatinate/L=Montabaur/emailAddress=server-certs@1und1.de/CN=mx-ha02.web.de
   i:/C=DE/O=T-Systems International GmbH/OU=T-Systems Trust Center/ST=Nordrhein Westfalen/postalCode=57250/L=Netphen/street=Untere Industriestr. 20/CN=TeleSec ServerPass DE-2
 1 s:/C=DE/O=T-Systems International GmbH/OU=T-Systems Trust Center/ST=Nordrhein Westfalen/postalCode=57250/L=Netphen/street=Untere Industriestr. 20/CN=TeleSec ServerPass DE-2
   i:/C=DE/O=Deutsche Telekom AG/OU=T-TeleSec Trust Center/CN=Deutsche Telekom Root CA 2
 2 s:/C=DE/O=Deutsche Telekom AG/OU=T-TeleSec Trust Center/CN=Deutsche Telekom Root CA 2
   i:/C=DE/O=Deutsche Telekom AG/OU=T-TeleSec Trust Center/CN=Deutsche Telekom Root CA 2
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIHWDCCBkCgAwIBAgIJAIKFxALDIgEwMA0GCSqGSIb3DQEBCwUAMIHZMQswCQYD
VQQGEwJERTElMCMGA1UEChMcVC1TeXN0ZW1zIEludGVybmF0aW9uYWwgR21iSDEf
MB0GA1UECxMWVC1TeXN0ZW1zIFRydXN0IENlbnRlcjEcMBoGA1UECBMTTm9yZHJo
ZWluIFdlc3RmYWxlbjEOMAwGA1UEERMFNTcyNTAxEDAOBgNVBAcTB05ldHBoZW4x
IDAeBgNVBAkTF1VudGVyZSBJbmR1c3RyaWVzdHIuIDIwMSAwHgYDVQQDExdUZWxl
U2VjIFNlcnZlclBhc3MgREUtMjAeFw0xNDA3MjIxMTIxNDZaFw0xNzA3MjcyMzU5
NTlaMIGfMQswCQYDVQQGEwJERTEeMBwGA1UECgwVMSYxIE1haWwgJiBNZWRpYSBH
bWJIMR0wGwYDVQQIExRSaGluZWxhbmQtUGFsYXRpbmF0ZTESMBAGA1UEBxMJTW9u
dGFiYXVyMSQwIgYJKoZIhvcNAQkBFhVzZXJ2ZXItY2VydHNAMXVuZDEuZGUxFzAV
BgNVBAMTDm14LWhhMDIud2ViLmRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAsnqo/VaFr5O5OZU1mxcFwnu9giEJNZwpZXcXbHM6UOoy9czWRQSeQrlM
GfcGWv/YX3qZeYhHIkjyu4+ufz03tATSHs1L7zNVDyqsemwRutCdvwvXXFINXz27
hH5wDfK1vPaIU+2D3x8krctq7qpeR+dlDC2awZhP49LQe4CitUXiLPIfFd9QzDEf
79Gb8dxhgY28LcOUBhVLmJn59SiAW1FI3VWIJqMUs2cIl1RlOKWx98cJAl40e8t2
4E4vmpn9+mIY2P3MbHrORP5GrXGfJk7g8q81EeZ+zEzlMjYJGdMEbFFAUSzU3B5H
uo3vIBdm4bn/Otsd5vYs63qErQWTQQIDAQABo4IDWTCCA1UwHwYDVR0jBBgwFoAU
VAQpb6KTxpAxRcA93iviCmmAkl8wDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQG
CCsGAQUFBwMCBggrBgEFBQcDATAdBgNVHQ4EFgQUNlKFpu9CRZkkDVnDj0WTvOvs
ehAwWQYDVR0gBFIwUDBEBgkrBgEEAb1HDQIwNzA1BggrBgEFBQcCARYpaHR0cDov
L3d3dy50ZWxlc2VjLmRlL3NlcnZlcnBhc3MvY3BzLmh0bWwwCAYGZ4EMAQICMIIB
IQYDVR0fBIIBGDCCARQwRaBDoEGGP2h0dHA6Ly9jcmwuc2VydmVycGFzcy50ZWxl
c2VjLmRlL3JsL1RlbGVTZWNfU2VydmVyUGFzc19ERS0yLmNybDCByqCBx6CBxIaB
wWxkYXA6Ly9sZGFwLnNlcnZlcnBhc3MudGVsZXNlYy5kZS9jbj1UZWxlU2VjJTIw
U2VydmVyUGFzcyUyMERFLTIsb3U9VC1TeXN0ZW1zJTIwVHJ1c3QlMjBDZW50ZXIs
bz1ULVN5c3RlbXMlMjBJbnRlcm5hdGlvbmFsJTIwR21iSCxjPWRlP2NlcnRpZmlj
YXRlUmV2b2NhdGlvbmxpc3Q/YmFzZT9jZXJ0aWZpY2F0ZVJldm9jYXRpb25saXN0
PSowggE5BggrBgEFBQcBAQSCASswggEnMDMGCCsGAQUFBzABhidodHRwOi8vb2Nz
cC5zZXJ2ZXJwYXNzLnRlbGVzZWMuZGUvb2NzcHIwTAYIKwYBBQUHMAKGQGh0dHA6
Ly9jcmwuc2VydmVycGFzcy50ZWxlc2VjLmRlL2NydC9UZWxlU2VjX1NlcnZlclBh
c3NfREUtMi5jZXIwgaEGCCsGAQUFBzAChoGUbGRhcDovL2xkYXAuc2VydmVycGFz
cy50ZWxlc2VjLmRlL2NuPVRlbGVTZWMlMjBTZXJ2ZXJQYXNzJTIwREUtMixvdT1U
LVN5c3RlbXMlMjBUcnVzdCUyMENlbnRlcixvPVQtU3lzdGVtcyUyMEludGVybmF0
aW9uYWwlMjBHbWJILGM9ZGU/Y0FDZXJ0aWZpY2F0ZTAMBgNVHRMBAf8EAjAAMBkG
A1UdEQQSMBCCDm14LWhhMDIud2ViLmRlMA0GCSqGSIb3DQEBCwUAA4IBAQAhtoJC
5AfRSsG2akrc9SSf8fTaT/5pB5o3K6HOp799pAWcBRhmrt+eImXrwta7QNCc4q0I
L1jp/3NIblYZUgp6CF043eK3apSG6iJOaCVOYxHR+/gazMsbmyT4G1eFJW1iwjdj
hU9WpUZQNG3OGrNLB5i2bJhO+HQlPA3xQw2Z75LlT3Vq4J0+HSLQhwv2pbSY8UhQ
MAgWZXYVE3MtKx+iE30aeW8kstf0Od4/mgxLQy4iXy35WznlcNC8+hXq0Q5pShzk
j+o3kDlxbEYA3vQJSG84ZIhlNR83jCHnXQHhgskc7/4wWBeTBXVbuc+W5ZIUYnwD
TxPS+wXjVVViafm8
-----END CERTIFICATE-----
subject=/C=DE/O=1&1 Mail & Media GmbH/ST=Rhineland-Palatinate/L=Montabaur/emailAddress=server-certs@1und1.de/CN=mx-ha02.web.de
issuer=/C=DE/O=T-Systems International GmbH/OU=T-Systems Trust Center/ST=Nordrhein Westfalen/postalCode=57250/L=Netphen/street=Untere Industriestr. 20/CN=TeleSec ServerPass DE-2
---
No client certificate CA names sent
---
SSL handshake has read 5647 bytes and written 515 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: CCEDD85A875A89BA92893191F2EE7C4AD15D5776A3B359467D392F972928995C
    Session-ID-ctx: 
    Master-Key: 308885CE617D0CE7A3B551329AB7B79CDC9CDA545158EB0C35FD9704124138D1487528A5F01FA9461A6FC9D26BC55D14
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1413453455
    Timeout   : 7200 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---
250 STARTTLS