function Test-SmtpTls {
    param([string]$Server, [int]$Port = 25, [string]$ExportPath)

    $script:cert = $null
    # Cert im Callback als eigene Kopie sichern - das Handle wird nach dem
    # Schliessen der Verbindung sonst ungueltig.
    $cb = { param($sndr,$crt,$ch,$e)
        $script:cert = New-Object Security.Cryptography.X509Certificates.X509Certificate2 (,$crt.RawData); $true }

    foreach ($proto in 'Tls13','Tls12','Tls11','Tls') {
        $p = [System.Security.Authentication.SslProtocols]$proto
        $tcp = New-Object Net.Sockets.TcpClient
        try {
            $tcp.Connect($Server, $Port)
            $s = $tcp.GetStream()
            $r = New-Object IO.StreamReader($s)
            $w = New-Object IO.StreamWriter($s); $w.AutoFlush = $true
            $r.ReadLine() | Out-Null                       # 220 Banner
            $w.WriteLine("EHLO test.local")
            do { $l = $r.ReadLine() } while ($l -notmatch '^250 ')
            $w.WriteLine("STARTTLS"); $r.ReadLine() | Out-Null   # 220 Ready
            $ssl = New-Object Net.Security.SslStream($s, $false, $cb)
            $ssl.AuthenticateAsClient($Server, $null, $p, $false)
            "{0,-6} OK   {1} {2}-bit / {3}" -f $proto, $ssl.CipherAlgorithm, $ssl.CipherStrength, $ssl.HashAlgorithm
            $ssl.Dispose()
        } catch {
            "{0,-6} FAIL {1}" -f $proto, $_.Exception.InnerException.Message
        } finally { $tcp.Close() }
    }

    # --- Zertifikat vom Server anzeigen ---------------------------------
    if ($script:cert) {
        $c   = $script:cert
        $sanExt = $c.Extensions | ? { $_.Oid.Value -eq '2.5.29.17' }
        $san = if ($sanExt) { $sanExt.Format($false) } else { '(keine)' }
        $sha256 = ($c.GetCertHashString('SHA256'))

        ""
        "=== Zertifikat ($Server) ==="
        [PSCustomObject][ordered]@{
            Subject    = $c.Subject
            Issuer     = $c.Issuer
            Serial     = $c.SerialNumber
            Thumbprint = $c.Thumbprint
            SHA256     = $sha256
            NotBefore  = $c.NotBefore
            NotAfter   = $c.NotAfter
            DaysLeft   = [int]($c.NotAfter - (Get-Date)).TotalDays
            Valid      = ($c.NotBefore -le (Get-Date)) -and ($c.NotAfter -ge (Get-Date))
            SigAlg     = $c.SignatureAlgorithm.FriendlyName
            KeySize    = $c.PublicKey.Key.KeySize
            SAN        = $san
        } | Format-List

        if ($ExportPath) {
            if (Test-Path -LiteralPath $ExportPath -PathType Container) {
                $ExportPath = Join-Path $ExportPath ("{0}_{1}.cer" -f ($Server -replace '[^\w.\-]','_'), $Port)
            }
            [IO.File]::WriteAllBytes($ExportPath, $c.Export('Cert'))
            "Exportiert: $ExportPath"
        }
    } else {
        "Kein Zertifikat empfangen (kein TLS-Handshake erfolgreich?)."
    }
}

$domain = "contoso.com"
$res    = Resolve-DnsName -Type MX $domain
$server = ($res | select -First 1).NameExchange

#$server = $env:COMPUTERNAME

Test-SmtpTls -Server $server
# Mit Export:  Test-SmtpTls -Server $server -ExportPath C:\Temp