[stunnel-users] stunnel smtp tls frontend server/proxy for remote backend postfix

I'm running stunnel in server mode and listening on port 587 and trying to connect to a remote postfix server running on port 25.

NB: the two servers are connected via zerortier, which may or may no be relevant to the issue.

DEBUG = 7

[ssmtp] protocol = smtp accept = google_cloud_internal_ip:587 connect = remote_zerotier_postfix_ip:25 cert = /etc/stunnel/domain.pem

I thought this would set up stunnel to handle the TLS handshake and terminate the TLS connection, while proxing to the backend postfix server without requiring postfix to worry about TLS. But I'm getting LOG3[0]: STARTTLS expected when stunnel tries to connect to postfix. If I put stunnel in client mode, then it doesn't negotiate the incoming TLS (right?).

What am I missing?