cert = /path/to/certnew.cer key = /path/to/stunnel.pem

Or concatenate them into one file and use cert = ... only (no key = ...).

Also take care that the CN is the server FQDN to which the client connects.

Thanks, it works now perfect!