ios12 clients not getting correct certificate, sni supported not? or config error?

I am having an ios12.4.1 client whine about access problems. He is getting the 'default' self signed ceritificate instead of the hostname alias. openssl s_client -servername mail.xxxxx.com -connect x.x.x.x:pop3s gives a 'Verify return code: 0 (ok)'

I can't imagine this sni support is not available in recent versions. Should I remove this default certificate in the main section of 10-ssl.conf?

These lines I have added to 10-ssl.conf

ssl_cert =

local 192.168.10.43 { ssl_key =

[@ conf.d]# doveconf | egrep 'ssl_cert|ssl_key' ssl_cert =