On Tue, 2016-05-17 13:33:31 +0000, David Faizulaev wrote:

Between each certificate block I have the following block:

Bag Attributes friendlyName: trustcenterclass2caii 2.16.840.1.113894.746875.1.1: <Unsupported tag 6> subject=/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 2 CA/CN=TC TrustCenter Class 2 CA II issuer=/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 2 CA/CN=TC TrustCenter Class 2 CA II

possible cause?

No, this should be ignored as a comment.

But you instructed stunnel to check the peer's certificate against the trusted ones (verify = 2), and the certificate chain the peer presents ends with a certificate not found in the CA file.

Ludolf