Sorry to speak up well into this thread, but I found the following useful :
http://www.linuxmanagers.org/pipermail/linuxmanagers/2003-April/001100.html
I performed the method #2 mentioned in the above for imaps & pops
I also performed the above for sendmail, except I did not combined the key and signed certificate (steps e and f) and used the following as my guide for sendmail (although this is for FreeBSD):
http://www.puresimplicity.net/~hemi/freebsd/sendmail.html
I imported the cacert.pem into Mozilla Thunderbird and it is happy.
- Mike