If you don't what a certificate is, or how to create one, Google is your
friend.
I don't see why you would expect list members to hold your hand on that.
Conceptually it's quite simple, see the man page and look
at the options for ssl_mode. I use ssl_outgoing in that line
of the perdition.pop3.conf file to enforce that all backend
connections are by SSL. But there are other choices and
you can stack up options to get the behaviour you want.
The are also options in the config to set up debug logging
so you can create a connection and watch it's progress in
greater detail. See "debug" and "connection logging".
Regards