[schenk:~] 20s $ openssl s_client -connect smtp.eckelmann.de:25 -starttls smtp
CONNECTED(00000003)
depth=1 DC = group, DC = eckelmann, CN = Eckelmann Gruppe CA
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = DE, ST = Hessen, L = Wiesbaden, O = Eckelmann AG, OU = IT, CN = oa.eckelmann.de
verify return:1
---
Certificate chain
 0 s:C = DE, ST = Hessen, L = Wiesbaden, O = Eckelmann AG, OU = IT, CN = oa.eckelmann.de
   i:DC = group, DC = eckelmann, CN = Eckelmann Gruppe CA
 1 s:DC = group, DC = eckelmann, CN = Eckelmann Gruppe CA
   i:CN = Eckelmann Gruppe Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIHpTCCBo2gAwIBAgITRQAAEtLkz9CDK1uh5QAAAAAS0jANBgkqhkiG9w0BAQsF
ADBQMRUwEwYKCZImiZPyLGQBGRYFZ3JvdXAxGTAXBgoJkiaJk/IsZAEZFgllY2tl
bG1hbm4xHDAaBgNVBAMTE0Vja2VsbWFubiBHcnVwcGUgQ0EwHhcNMTcwODIyMTMw
MzIxWhcNMjUwMzE3MTAyNjA4WjBwMQswCQYDVQQGEwJERTEPMA0GA1UECBMGSGVz
c2VuMRIwEAYDVQQHEwlXaWVzYmFkZW4xFTATBgNVBAoTDEVja2VsbWFubiBBRzEL
MAkGA1UECxMCSVQxGDAWBgNVBAMTD29hLmVja2VsbWFubi5kZTCCASIwDQYJKoZI
hvcNAQEBBQADggEPADCCAQoCggEBAKMeXtL+5o8uRLoBRs5FlZc00RktWmyx0e7W
zLaZBqX6h0HHZnNwdh2lBrkAtfBm5D50SCncfrPfkmjONmcYHR215+pfubBHiWxs
Z2T57ZUfNqIBuUhLoc3DRp0iMCJPNjUdluPdcN465i2QPAzvk9myyQhFkwBZYkfB
ERostbqa0R8RSgVKKgj/l8dpN9lnNF+xZbociKNUN/r4AD7otO4/Y2VKYbmvLANw
LaIYqhkUp9sTFBLsJo95cQNBYJMHyNh2luDjeiFCRjedDsWKOIieK4XV+eRYWPhv
jJIDzmJO40Q4JH1Y77Dos+RdEMqouyhs4z83f11HhcVLZ+jLiesCAwEAAaOCBFYw
ggRSMIIBKQYDVR0RBIIBIDCCARyCD29hLmVja2VsbWFubi5kZYIUd2VibWFpbC5l
Y2tlbG1hbm4uZGWCGWF1dG9kaXNjb3Zlci5lY2tlbG1hbm4uZGWCEXNtdHAuZWNr
ZWxtYW5uLmRlghBwb3AuZWNrZWxtYW5uLmRlghFpbWFwLmVja2VsbWFubi5kZYIX
ZXgtc3J2MS5lY2tlbG1hbm4uZ3JvdXCCF2V4LXNydjIuZWNrZWxtYW5uLmdyb3Vw
ghpSZWxheS1leC1zcnYxLmVja2VsbWFubi5kZYIaUmVsYXktZXgtc3J2Mi5lY2tl
bG1hbm4uZGWCGUludGVybmV0LW91dC5lY2tlbG1hbm4uZGWCCWxvY2FsaG9zdIIH
RVgtU1JWMYIHRVgtU1JWMjAdBgNVHQ4EFgQUT5CC6MzXHjd6UyY2azWpsZDm3vkw
HwYDVR0jBBgwFoAUV82ggckyD6AGMhFPfeOxCz2F2g8wggEkBgNVHR8EggEbMIIB
FzCCAROgggEPoIIBC4aBwmxkYXA6Ly8vQ049RWNrZWxtYW5uJTIwR3J1cHBlJTIw
Q0EsQ049Q0EtU1JWMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMs
Q049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1lY2tlbG1hbm4sREM9Z3Jv
dXA/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNS
TERpc3RyaWJ1dGlvblBvaW50hkRodHRwOi8vY2Etd2ViLmVja2VsbWFubi5ncm91
cC9DZXJ0RW5yb2xsL0Vja2VsbWFubiUyMEdydXBwZSUyMENBLmNybDCCATkGCCsG
AQUFBwEBBIIBKzCCAScwgboGCCsGAQUFBzAChoGtbGRhcDovLy9DTj1FY2tlbG1h
bm4lMjBHcnVwcGUlMjBDQSxDTj1BSUEsQ049UHVibGljJTIwS2V5JTIwU2Vydmlj
ZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1lY2tlbG1hbm4sREM9
Z3JvdXA/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRp
b25BdXRob3JpdHkwaAYIKwYBBQUHMAKGXGh0dHA6Ly9jYS13ZWIuZWNrZWxtYW5u
Lmdyb3VwL0NlcnRFbnJvbGwvQ0EtU1JWMS5lY2tlbG1hbm4uZ3JvdXBfRWNrZWxt
YW5uJTIwR3J1cHBlJTIwQ0EuY3J0MA4GA1UdDwEB/wQEAwIFoDA8BgkrBgEEAYI3
FQcELzAtBiUrBgEEAYI3FQiF2vRehaXRWYPNgTWD8PkdiOhYfIXs53KCyKZHAgFm
AgEAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBsGCSsGAQQBgjcVCgQOMAwwCgYIKwYB
BQUHAwEwDQYJKoZIhvcNAQELBQADggEBAAwsCaNe5vQwNER/NveEYpW0roIQr+3Z
zD9FHQDzHZ4HknBnt3NeiU3Sk5uKdf202lHf0767ZFs42lp5sjn0BLvzHWQadaR7
pYYR2n2jED1oFmyufBHwZ9HFbPD6TfrEMD3jul5SMH7gSlBf0v5oi5rWiu56bFDw
6CswMgNX2+XHqc3W02MYJ74lF6T7GPI8+7KfnfvHLq+x0cDI6yB6tXZw6ZQTXMU2
6QbIKP2Oxu+npUkWBzZ+4wuaPdtlli/OrVMi3sogu+3YxNw87o5rgaUwukwk1u9f
D5OM2giqjlQLklER/BrhlTZaqF6m2Xggz5d1LTEkZagJtKrEk9g5OxA=
-----END CERTIFICATE-----
subject=C = DE, ST = Hessen, L = Wiesbaden, O = Eckelmann AG, OU = IT, CN = oa.eckelmann.de

issuer=DC = group, DC = eckelmann, CN = Eckelmann Gruppe CA

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 4370 bytes and written 472 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 621D0000F9002CDD06EE6C4CDDFF5BEBB6775576DC2BDB3F354BA47751801D5E
    Session-ID-ctx: 
    Master-Key: 4A92C726893A9F11B79A325421E93BFD8EDF2131E465946BCCDDFFE194068D1415FD75E127E84D420FF6290591F3E8A7
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1595324556
    Timeout   : 7200 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
    Extended master secret: yes
---
250 XRDST