My exim server is configured to ask for a client certificates when a connection is made. I set up an ACL (at rcpt stage) to log or add a header resp. of the outcome of the certificate check:

```
warn
   encrypted = *
   ! verify = certificate
   #condition = ${if def:tls_in_peerdn {yes}{no}}   # -> newer versions of exim use $tls_in_peerdn!
   condition = ${if def:tls_peerdn {yes}{no}} 
   add_header = X-TLS-Client-Certificate: invalid (${tls_peerdn})
   log_message = Invalid TLS client certificate presented (${tls_peerdn}).

warn
   encrypted = *
   ! verify = certificate
   condition = ${if def:tls_peerdn {no}{yes}} 
  log_message = No TLS client certificate presented.

warn
   verify = certificate  
   add_header = X-TLS-Client-Certificate: valid
   condition = false

```

Unfortunately no message I see ever gets checked as valid. The check for no certificate works though.

I set up

```
tls_try_verify_hosts = *

```

So the checking takes place and (using Debian, it is included in the standard config) the trust anchors are configured and accessible:

```
tls_verify_certificates = /etc/ssl/certs/ca-certificates.crt

```

Testing with... 

```
openssl s_client -CAfile /etc/ssl/certs/ca-certificates.crt -verify 4 -connect mailserver.dom.tld:25 -starttls smtp -cert /etc/ssl/letsencrypt/fullchain.pem -key /etc/ssl/letsencrypt/privkey.pem

```

...from the server to itself using the same key as the server uses, including the intermediate certs in the right order doesn't give a valid check result.

What am I missing?