And, reading more at StackOverflow, from where Virtue3's quotes are?, This: https://serverfault.com/questions/523804/is-starttls-less-safe-than-tls-ssl https://

And, reading more at StackOverflow, from where Virtue3's quotes are?, This: https://serverfault.com/questions/523804/is-starttls-less-safe-than-tls-ssl https://serverfault.com/questions/523804/is-starttls-less-sa... I find: > If the client is configured to require TLS, the two approaches are more-or-less equally safe. But there are some subtleties about how STARTTLS must be used to make it safe, and it's a bit harder for the STARTTLS implementation to get those details right. I previously thought that was the default, good to know it isn't / might not be Thanks everyone :-)