tlc client cert authentication -- fingerprint matches, but client's not trusted.

[pgndev]

I'm locking down a postfix smarthost.

Goal is to only accept submissions to the smarthost from clients that
match known TLS fingerprints.

smarthost' service config is

    [172.30.6.19]:587  inet  n  -  n  -  -  smtpd
      -o syslog_name=postfix/smarthost
      -o smtp_helo_name=smarthost.${myhostname}
      -o smtpd_tls_loglevel=2
      -o smtpd_enforce_tls=yes
      -o smtpd_tls_auth_only=no
      -o smtpd_tls_security_level=encrypt
      -o smtpd_tls_mandatory_protocols=!TLSv1.1,!TLSv1,!SSLv3,!SSLv2
      -o smtpd_tls_mandatory_ciphers=high
      -o smtpd_sasl_auth_enable=no
      -o smtpd_tls_wrappermode=no
      -o relay_clientcerts=lmdb:/etc/postfix/smarthost_clientcerts
      -o smtpd_tls_req_ccert=yes
      -o smtpd_tls_ccert_verifydepth=2
      -o smtpd_tls_CApath=/etc/ssl/certs
      -o smtpd_tls_fingerprint_digest=sha1
      -o smtpd_client_restrictions=
      -o smtpd_helo_restrictions=
      -o smtpd_sender_restrictions=
      -o 
smtpd_relay_restrictions=permit_mynetworks,permit_tls_clientcerts,reject_unauth_destination
      -o smtpd_recipient_restrictions=
      -o smtpd_data_restrictions=
      -o smtpd_end_of_data_restrictions=
      -o smtpd_etrn_restrictions=
      -o alias_maps=
      -o alias_database=
      -o relayhost=
      -o relay_domains=
      -o content_filter=

The test client's crt fingerprint is

    openssl x509 -pubkey -noout -in commercial.crt | openssl pkey
-pubin -outform DER | openssl dgst -sha1 -c
        (stdin)= 17:32:c4:9c:1e:c7:3d:13:ff:09:ec:19:ef:d3:13:1c:96:d3:e4:c3

I've def'd

    cat /etc/postfix/smarthost_clientcerts
        17:32:c4:9c:1e:c7:3d:13:ff:09:ec:19:ef:d3:13:1c:96:d3:e4:c3
commercial.crt

On mail submit from the client via the smarthost, log on the smarthost reports

    May 18 19:14:56 border postfix/smarthost/smtpd[9615]:
internal.XXX.com[172.30.7.113]: subject_CN=*.XXX.com, issuer=COMODO
RSA Domain Validation Secure Server CA,
fingerprint=42:1C:FD:99:2F:81:B2:55:07:42:D5:1F:EF:49:6D:43:96:1E:BC:D9,
pkey_fingerprint=17:32:c4:9c:1e:c7:3d:13:ff:09:ec:19:ef:d3:13:1c:96:d3:e4:c3
    May 18 19:14:56 border postfix/smarthost/smtpd[9615]: Untrusted
TLS connection established from internal.XXX.com[172.30.7.113]:
TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
    May 18 19:14:56 border postfix/smarthost/smtpd[9615]: NOQUEUE:
abort: TLS from internal.XXX.com[172.30.7.113]: Client certificate not
trusted

The pkey_fingerprint= matches, but the Client's not trusted.

I've missed something.  Why's this not matching?

PGNd