$ openssl s_client -starttls smtp -crlf -ssl3 -connect mx1.mail.icloud.com:25
CONNECTED(00000003)
depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=California/L=Cupertino/O=Apple Inc./CN=*.mail.icloud.com
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
 1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
 2 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
   i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFEzCCA/ugAwIBAgIQZidexZhFVhuBDHe+GiR/AzANBgkqhkiG9w0BAQUFADCB
tTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug
YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykxMDEvMC0GA1UEAxMm
VmVyaVNpZ24gQ2xhc3MgMyBTZWN1cmUgU2VydmVyIENBIC0gRzMwHhcNMTQwNzEx
MDAwMDAwWhcNMTUwODA4MjM1OTU5WjBnMQswCQYDVQQGEwJVUzETMBEGA1UECBMK
Q2FsaWZvcm5pYTESMBAGA1UEBxQJQ3VwZXJ0aW5vMRMwEQYDVQQKFApBcHBsZSBJ
bmMuMRowGAYDVQQDFBEqLm1haWwuaWNsb3VkLmNvbTCCASIwDQYJKoZIhvcNAQEB
BQADggEPADCCAQoCggEBALGbvOJcSuC4SeIDum+ovrb86MRB56u0ImVyj1EUU0mQ
+SxOnaGkKOTXBXlrtvHnBqj8r5PComddovoQOXuCFChIPUQ1wvjJV/ofG4+I6rVt
xvNdGVXAG2kFTiGqF7bJL2r1J7fCI1oIeC0PJ4BgUsfaoYwtXIRTOWLE+JJ/Ju44
YrjW93cMmPY+m2Q+0GJVQFrSH5/UsJk4bcc28pXZRTtChvP4dp+PzTlNncfE5CBJ
fufN7Tg7M+K2yNm/9aFEIoBRLH0xR0WloIiR7kWarlQg8qiv37uCUcOR9OK+Xjd9
Hnf3rlNwu2Mx1CXJhdt8AQByTm5eggfBzZ2OCv766Z0CAwEAAaOCAWowggFmMBwG
A1UdEQQVMBOCESoubWFpbC5pY2xvdWQuY29tMAkGA1UdEwQCMAAwDgYDVR0PAQH/
BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBlBgNVHSAEXjBc
MFoGCmCGSAGG+EUBBzYwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNv
bS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYD
VR0jBBgwFoAUDURcFlNEwYJ+HSCrJfQBY9i+eaUwKwYDVR0fBCQwIjAgoB6gHIYa
aHR0cDovL3NkLnN5bWNiLmNvbS9zZC5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsG
AQUFBzABhhNodHRwOi8vc2Quc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8v
c2Quc3ltY2IuY29tL3NkLmNydDANBgkqhkiG9w0BAQUFAAOCAQEASwxCFiUf1E03
EgV0RPjcWTr6oHbPiJ8lUF1buJwEBtCPE+dpSa1aVefE4AzslPvPeo2/ahJvNBv5
VjDNhScHaSg7OMQR+DMxwF4E2n+lxm+IMO79LdS2trN8Htm7hLUg8fwVvco6XK3u
TDwFSJUUZmAeMTGl7mUn2KAdNJP7BvGNf2fjCKgmq4sW4029fXNtgBPs/mhvExAm
KgrwjBw5NbUyoZ+tPa9G6udJkTrq/6/wYsCv7tBq9pILWd30H03CHg2i+55mYJSk
D0m8KNUDPs/Rd4bfJ4cwRMi4Y3F1nSqN+5hQiQy5gqtB4NKNW3TNJhc458tvDT5G
1zYwmPj3ZA==
-----END CERTIFICATE-----
subject=/C=US/ST=California/L=Cupertino/O=Apple Inc./CN=*.mail.icloud.com
issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
---
No client certificate CA names sent
---
SSL handshake has read 5073 bytes and written 315 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : SSLv3
    Cipher    : ECDHE-RSA-AES256-SHA
    Session-ID: 0E6C85C09E25F5B86E32C67BEE2619D20BA394929CF70EC2BE683048D4DD3F91
    Session-ID-ctx: 
    Master-Key: 8B06A159BD6E0BF756F6F2C17A71823FFE47AFD0F31EBB3CF0B0C1408738094E87BAD24A1C1DC97DE4A8BF6FBEA1F290
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1413453525
    Timeout   : 7200 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---
250 SIZE 0