You might be better of with nginx stream to offload (ssl/tls), all of it is then encrypted.

stream {
upstream backendsmtp {
server 192.168.3.32:25;
}
server {
listen 1234 ssl;
ssl_certificate /nginx/crts/global1.cert;
ssl_certificate_key /nginx/crts/global1.key;
include /nginx/conf/sslciphers.conf;
proxy_pass backendsmtp;
....................

---
nginx for Windows http://nginx-win.ecsds.eu/