$ openssl s_client -starttls smtp -crlf -ssl3 -connect mx.arcor.de:25
CONNECTED(00000003)
depth=3 C = ZA, ST = Western Cape, L = Cape Town, O = Thawte Consulting cc, OU = Certification Services Division, CN = Thawte Premium Server CA, emailAddress = premium-server@thawte.com
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
 0 s:/C=DE/ST=NRW/L=Duesseldorf/O=Vodafone D2 GmbH/CN=mx.arcor.de
   i:/C=US/O=Thawte, Inc./CN=Thawte SSL CA
 1 s:/C=US/O=Thawte, Inc./CN=Thawte SSL CA
   i:/C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA
 2 s:/C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA
   i:/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
 3 s:/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
   i:/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDyTCCArGgAwIBAgIQdbVIEN7Q22hWxxsMssbF4TANBgkqhkiG9w0BAQUFADA8
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMVGhhd3RlLCBJbmMuMRYwFAYDVQQDEw1U
aGF3dGUgU1NMIENBMB4XDTExMDYyMjAwMDAwMFoXDTE2MDYyMDIzNTk1OVowYjEL
MAkGA1UEBhMCREUxDDAKBgNVBAgTA05SVzEUMBIGA1UEBxQLRHVlc3NlbGRvcmYx
GTAXBgNVBAoUEFZvZGFmb25lIEQyIEdtYkgxFDASBgNVBAMUC214LmFyY29yLmRl
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0YOToZWmm2TKOT4IzdiO
6CP8SJnkfSPhQypzFKWq3o8kRv484+VmcbH2IOpyocLnggtciI1QMuKs3OxZm5ig
z6l71yAmf6n5GgUZY5gYhRRKok+i2yZ7vM5W3Zb8z3ENhfkyKolnyQOSc9zLmr0G
9drtwzuf2ydrT/sL59deQ7kAp3STFiV4EpCyKpIZsRxCoaUwB+KM1vtLndfF1ZjX
bKc2cDckaNinavHEzdsa3koFI2MwqjP1Ms6q/PFdjTDU9C7BpvMNxCiXT+o2yyI2
ptYnM9NSYaM5ZRFqjUOy0GiNl1P9hcWzr/Sl5vPP1XTF/dtA2TgHlC29e8E7XmgA
xQIDAQABo4GgMIGdMAwGA1UdEwEB/wQCMAAwOgYDVR0fBDMwMTAvoC2gK4YpaHR0
cDovL3N2ci1vdi1jcmwudGhhd3RlLmNvbS9UaGF3dGVPVi5jcmwwHQYDVR0lBBYw
FAYIKwYBBQUHAwEGCCsGAQUFBwMCMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AYYWaHR0cDovL29jc3AudGhhd3RlLmNvbTANBgkqhkiG9w0BAQUFAAOCAQEAPXIz
d1E+r8kPIpsxKA72uTtQOWkLwaCMwdSEQ1oAYZcDPdV7LvTAXFkVhFGSKgPkfQ4Y
UzB5oxJwbTqDjTa82CbEeELu20FG54QqtAnO7PONva9GxaWx+/3LmPIWJ+mp1hv3
pQyFK5Noa/RG2d2fzBNNyBaA9czfjT8shsUxbn7Asa4C144vWzcEKleyOegGGWT0
2qoOS6Qn7RoHqI68skh8Nki5ya9nlt67QkmBhSMtAvXdNCVN3bBbaQzcwKOT+0HT
x4HxwlUA1RdWoETeOPu4fFCyMwhC7iYzGwZLOmKy8AJ2FORx2MPKvz7qneTSdV0o
fkD6uo8nEOoD2hd6Ow==
-----END CERTIFICATE-----
subject=/C=DE/ST=NRW/L=Duesseldorf/O=Vodafone D2 GmbH/CN=mx.arcor.de
issuer=/C=US/O=Thawte, Inc./CN=Thawte SSL CA
---
No client certificate CA names sent
---
SSL handshake has read 4949 bytes and written 387 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: DE6A893D338E16BC844DABB45C7F4BD31336B12F7D1689D508B03380CDA52B55
    Session-ID-ctx: 
    Master-Key: 9F8D24024596967088CD2DC6ED353CDF8319DCC4CD0B41860BC25A9AD6D23C9DAB35AEE4C6DB6A04F59F2225D1E11508
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1413453401
    Timeout   : 7200 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---
250 DSN