I used this command to get the certificate: openssl s_client -starttls imap -connect 127.0.0.1:1143 -showcerts

From the output I copied everything between BEGIN_CERTIFICATE and END_CERTIFICATE lines including them and saved that to a file.

Then into accounts.conf I added source-cafile and outgoing-cafile fields with the value being a path to the saved certificate file.

I made a patch to pin certificate and I use it locally with protonmail-bridge. That patch is available in the mailing list: https://lists.sr.ht/~sircmpwn/aerc/patches/20445