The issue had arisen, because I'm using a self-signed cert for Postfix, but that had been rejected. Making the fingerprint of said cert known to IO::Socket::SSL (and subsequently Net::SSLeay) made it accept the cert without complaint, and now the TLS runs smoothly. Thanks for your effort.