I found out that with the option -verify 5 openssl is going deep in the chain showing all the cert, even that not included in your certificate deployment.
If you really want to understand which chain is provided with your certificate you should run:
openssl s_client -showcerts -partial_chain -connect YOUR_ENDPOINT:443 < /dev/null |less
Question is quite old but I had the same problem and couldn't find anything valuable, so I want to share this in case it might be useful for someone.
I'm using Evolution 3.32.5 on Linux and you can export the certificates
1) in the certificate view (main window → menu "Edit → Preferences" → Certificates).
2) select a certificate, click button "view" and ...
You can check any of several online tutorials on this topic.
Basically you activate TLS normally, then add an authorization rule that will require a client certificate:
This will cause the access to fail and the browser to ask the customer to select among the available certificates, that must have been already installed in the ...