````default: true````

Are you sure about that?  I certainly wouldn't want this to ever be on.   It's definitely default: false currently and the node docs say the same:

`````
rejectUnauthorized: If true the server will reject any connection which is not authorized with the list of supplied CAs. This option only has an effect if requestCert is true. Default: false.
`````

I can't really ever see this being a useful thing to set on an SMTP server; if someone really wanted this - it would be far better done in a plugin by checking the authorized result.   However it would require the capability for Haraka to pass the `ca` argument to tls.createServer() so you could supply a list of acceptable certificates which we currently don't have.