I believe you want $auth2 for PLAIN, $auth1 for LOGIN.
> server_advertise_condition = ${if eq{$tls_cipher}{}{no}{yes}}
It's normal to use the format in the examples in the spec:
${if def:tls_cipher }
That said, what you have looks fine and *should* work.
> Does anyone have an idea why?
exim -d+tls+expand -oX 24 -bd
Connect, start TLS, look at the logging output?
Since you're using GnuTLS, then:
gnutls-cli --starttls --crlf --port 587 localhost
Do the EHLO, type STARTTLS, when you get the 220 to proceed, type Ctrl-D
(or whatever you've mapped EOF to) and when the TLS negotiation
finishes, redo the EHLO.
