$ openssl s_client -starttls smtp -crlf -ssl3 -connect mta5.am0.yahoodns.net:25
CONNECTED(00000003)
depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=California/L=Sunnyvale/O=Yahoo Inc./OU=Information Technology/CN=*.am0.yahoodns.net
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
 1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
 2 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
   i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFtDCCBJygAwIBAgIQJQyI3kPZpZGjw5gXX41ldjANBgkqhkiG9w0BAQUFADCB
tTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug
YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykxMDEvMC0GA1UEAxMm
VmVyaVNpZ24gQ2xhc3MgMyBTZWN1cmUgU2VydmVyIENBIC0gRzMwHhcNMTQwNjEw
MDAwMDAwWhcNMTUwNjExMjM1OTU5WjCBiTELMAkGA1UEBhMCVVMxEzARBgNVBAgT
CkNhbGlmb3JuaWExEjAQBgNVBAcUCVN1bm55dmFsZTETMBEGA1UEChQKWWFob28g
SW5jLjEfMB0GA1UECxQWSW5mb3JtYXRpb24gVGVjaG5vbG9neTEbMBkGA1UEAxQS
Ki5hbTAueWFob29kbnMubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAvHHT9HM0beYNGmznE/5rdsl04wqWzZDd/78tZpf4aUj7UcRdfwjjad6pjFsj
x61CYklgVhme32tp/ZrcsqI/uNKGzegF2tGIUGidx0lvUtYNbtKgiq+N2QbHrqX8
4GVC1qMpbLLyMGu+ucdtu6xnK26dU4RZISOPmemh5JkF6MqaSr0XTC7KtDcHTvUO
xmlSyMJr8lwjqjeHZBTLhgyHSwKNhOotfCcv3NGQVqf1n+WpU8wpK/FWmJhz7Byk
xqcU2/0JNFFB1KoWfYpsnY0BkhwWNCSe53ZVlc4tysixtb9/gQqO5sgH38rVSPgl
SlL0dtcKNNUO+eSxJYpuBBjBNwIDAQABo4IB6DCCAeQwgZkGA1UdEQSBkTCBjoIS
Ki5hbTAueWFob29kbnMubmV0ghcqLm1haWwuYW0wLnlhaG9vZG5zLm5ldIIcKi5z
YmNnbG9iYWwuYW0wLnlhaG9vZG5zLm5ldIIXKi5tYWlsLmdtMC55YWhvb2Rucy5u
ZXSCEiouZ20wLnlhaG9vZG5zLm5ldIIUKi50bnoubWFpbC55YWhvby5jb20wCQYD
VR0TBAIwADAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG
AQUFBwMCMGUGA1UdIAReMFwwWgYKYIZIAYb4RQEHNjBMMCMGCCsGAQUFBwIBFhdo
dHRwczovL2Quc3ltY2IuY29tL2NwczAlBggrBgEFBQcCAjAZGhdodHRwczovL2Qu
c3ltY2IuY29tL3JwYTAfBgNVHSMEGDAWgBQNRFwWU0TBgn4dIKsl9AFj2L55pTAr
BgNVHR8EJDAiMCCgHqAchhpodHRwOi8vc2Quc3ltY2IuY29tL3NkLmNybDBXBggr
BgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly9zZC5zeW1jZC5jb20wJgYI
KwYBBQUHMAKGGmh0dHA6Ly9zZC5zeW1jYi5jb20vc2QuY3J0MA0GCSqGSIb3DQEB
BQUAA4IBAQBMocF4L5jyfcgQjJiC8oAMq4EP5rpIq5Kd/oPCziVXQsq2yetCzWv0
YsHQQz0W11BZWPPRk2ENNql7R3AKS8ztVMmHQMwN7wJ7PYOBqgqq0/lUE323C6v8
uMgPENtr7MoI8off7OyEOZdfapqd6f30/CJ+NEJCUR33QU1r9WEJhg35SyxlQLkX
5xHgFcy6XrxLC3s44uN6RgoOPeCxw+tQGJ57SsXGDicT+aJ0Q/eSCdhU97aqVTGA
vwrHg3v9V220Z1Q6KjoGMfQuyd+XRqj7axPLbE0Iegl0NuMgXDJNITFbUKY7X1ZL
XRXv5xIFeS8Utr1rZWYdGPmxg4XxEeGT
-----END CERTIFICATE-----
subject=/C=US/ST=California/L=Sunnyvale/O=Yahoo Inc./OU=Information Technology/CN=*.am0.yahoodns.net
issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
---
No client certificate CA names sent
---
SSL handshake has read 4897 bytes and written 319 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-RC4-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : ECDHE-RSA-RC4-SHA
    Session-ID: D5EFFB929325D0167813614BE4878659D4AB7F1DDA6C766F8CF3F1DFCC42DD24
    Session-ID-ctx: 
    Master-Key: 17519310B2D1A2ACEA367735FB304609D0106505F30B6BDC9D97C32C395800E268B7114CD394D8204997C0CF6AEA0370
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1413453421
    Timeout   : 7200 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---
250 STARTTLS