[exim] exim 4.84 : self signed cert issue with TLS

recently upgraded to exim exim 4.84
getting errors : "A TLS fatal alert has been received.: CA is unknown"

This server has always been on a standalone network without internet
access. It needs to have a selfsigned cert for TLS.

How can this be fixed without going to internet access and a public CA?

Additionally
- any comments on use of openssl vs gnutls?
- any comments on the use of ssl on port 465 vs starttls on port 25

Thanks! 2016-07-18