STARTTLS fails with custom certificate (mTLS)

Hello 👋

I am running into a strange issue with Net::IMAP. I post here after trying to find a solution on the Ruby Discord server.

I'm trying to connect to an IMAP server using STARTTLS with a custom certificate.
When I call the starttls method, I get the following:

S: * OK [CAPABILITY IMAP4rev1 SASL-IR ID ENABLE IDLE LITERAL+ AUTH=EXTERNAL AUTH=PLAIN STARTTLS LOGINDISABLED] MSSPRO LPS-AUTH_CLI IMAP server ready.
C: RUBY0001 STARTTLS
S: RUBY0001 OK Begin TLS negotiation now
SSL_connect returned=1 errno=0 peeraddr=195.35.24.212:143 state=error: ssl/tls alert unexpected message (SSL alert number 10)
/Users/nathan/.local/share/mise/installs/ruby/3.4.6/lib/ruby/gems/3.4.0/gems/net-protocol-0.2.2/lib/net/protocol.rb:46:in 'OpenSSL::SSL::SSLSocket#connect_nonblock'
/Users/nathan/.local/share/mise/installs/ruby/3.4.6/lib/ruby/gems/3.4.0/gems/net-protocol-0.2.2/lib/net/protocol.rb:46:in 'Net::Protocol#ssl_socket_connect'
/Users/nathan/.local/share/mise/installs/ruby/3.4.6/lib/ruby/gems/3.4.0/gems/net-imap-0.5.10/lib/net/imap.rb:3789:in 'Net::IMAP#start_tls_session'
/Users/nathan/.local/share/mise/installs/ruby/3.4.6/lib/ruby/gems/3.4.0/gems/net-imap-0.5.10/lib/net/imap.rb:1402:in 'block in Net::IMAP#starttls'
/Users/nathan/.local/share/mise/installs/ruby/3.4.6/lib/ruby/gems/3.4.0/gems/net-imap-0.5.10/lib/net/imap.rb:3427:in 'block (2 levels) in Net::IMAP#receive_responses'
/Users/nathan/.local/share/mise/installs/ruby/3.4.6/lib/ruby/gems/3.4.0/gems/net-imap-0.5.10/lib/net/imap.rb:3426:in 'Array#each'
/Users/nathan/.local/share/mise/installs/ruby/3.4.6/lib/ruby/gems/3.4.0/gems/net-imap-0.5.10/lib/net/imap.rb:3426:in 'block in Net::IMAP#receive_responses'

I wrote a script that uses TCPSocket and OpenSSL::SSL::SSLSocket to connect to the server manually and it works fine.
I've also tried in Python with the imaplib and it works fine as well.

The three scripts are available in this gist: https://gist.github.com/4e4c52/543ea036030acc6b3d9e876a44777234

As I am trying to connect to a development server, I can provide the PKCS12 file and its password if it helps reproducing.

Start at net/imap.rb:3789, where Net::IMAP#start_tls_session is called, and review the starttls flow around net/imap.rb:1402. Compare its TLS setup with the working TCPSocket/OpenSSL script and Python imaplib example in the linked gist. Done means reproducing the custom-certificate mTLS failure and making STARTTLS work without breaking the existing connection flow.