bug#3362: 23.0.91; smtpmail and starttls

I am having difficulties to establish a communication to an smtp
server using smtpmail.el and starttls.el:

The incomplete connection I get is the following

Opening STARTTLS connection to `foo.bar.com:465'...done
220 foo.bar.com ESMTP Postfix
250-foo.bar.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250 8BITMIME
220 Ready to start TLS
STARTTLS negotiation failed: 20 Ready to start TLS
*** Starting TLS handshake
*** Fatal error: Key usage violation in certificate has been detected.
*** Handshake has failed

smtpmail-send-command: Process SMTP not running


My settings are

(setq smtpmail-auth-credentials '(("foo.bar.com" 465 "winkler" nil))
        smtpmail-starttls-credentials  '(("foo.bar.com" 465 nil nil))

I am not sure whether these settings are correct. Smtpmail doesn't
reach a point when it would ask for a password. -- I find the
docstrings of these variables a bit confusing as they do not comply
with the usual conventions for docstrings. Also, it is not clear to
me whether I need both variables. If yes, why are they apparently
redundant? And the default value for smtpmail-starttls-credentials
is confusing, too, as it cannot be used for anything.

What else to say? Using

  (setq smtpmail-debug-info t)

doesn't give any extra information. And I am using

gnutls-cli (GnuTLS) 2.4.1


In GNU Emacs 23.0.91.1 (i686-pc-linux-gnu, GTK+ Version 2.14.4)
 of 2009-03-23 on regnitz
Windowing system distributor `The X.Org Foundation', version 11.0.10502000