I cannot definitely say with confidence following answer is correct because I have not yet gone through the exim4 configuration after shifting to Hestia. Try it out:
TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42, session=
Most likely the answer is given in above alert bad certificate. This means it cannot invoke a TLS connection and cannot find files related required for a TLS connection.