openssl stunnel

[Didier Wiroth <didier_(_dot_)_wiroth_(_at_)_mcesr_(_dot_)_etat_(_dot_)_lu>]

hi,
(openbsd and security novice)

I have setup one of my first servers, 
The server will be used as a mail server, it is running openbsd3.7 with sendmail. I have some security concerns which I would like to resolve
a) My mail server is in a networkX
b) My clients use mainly windows workstations and are from different subnets from different internet providers.

Here are my main goals:
1) users should use encrypted and authenticated smtp connections to be able to relay mail to other domains
2) I would like to use a popa3d server "with" strong encryption (perhaps ssl tunneling with stunnel).

To be honest I'm not familiar with certificates, nor with certificate authorities (CA). 

Can someone point me to some good doc/howto... which might help me to resolve my configuration needs?

If you have a good link about how to create my own "certificate authority" on openbsd, it is also welcome!!! 

If possible I would like to keep popa3d and sendmail from the openbsd standard install.

many thanks for the help
didier