i grabbed this from a google I may be wrong here, but my understanding of certs is that what exim is doing is checking the authorities on your certificate. The idea is that I would tell exim to allow mail from certs signed by the CA. I am now able to issue certs for new users without having to log on to the box and add their certificate