Quanah Gibson-Mount writes:
TLS_CACERT /opt/zimbra/conf/ca/ca.pem (...) If I change it to TLS_CACERTDIR and adjust to a path, (...)
If I remember correctly TLS_CACERTDIR needs to be set up with some OpenSSL magic, it's not just a directory into which you can drop certificate files. Maybe the reverse is true as well, and a cert from a TLS_CACERTDIR does not work in TLS_CACERT.