SSl has nothing to do with certificates, it is a protocol.

Turning off the verification allows the email to work even with Avast's self-signed certificate
That is at least a strong indication that avast has nothing to do with it.
So I tried disabling each of web shield and network shield in turn, and then together, and none of those resolved the problem.
Those two shields have nothing to do with email.
Historically, I have not run mail shield because nPOPuk doesn't run scripts
Avast doesn't use scripts to check the mail.

It certainly looks like the problem is not avast but something else.