Ok so not a certificate issue.
Do you have other STunnel entries that might have misconfig?
Do you have some other service already listening on port 1636?
What happens if you just try to run the command at the CLI:
[24.03-RELEASE][admin@4200.stevew.lan]/root: stunnel
[ ] Initializing inetd mode configuration
[ ] Clients allowed=54725
[.] stunnel 5.71 on amd64-portbld-freebsd15.0 platform
[.] Compiled/running with OpenSSL 3.0.13 24 Oct 2023
[.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI
[ ] errno: (* __error())
[ ] Initializing inetd mode configuration
[.] Reading configuration from file /usr/local/etc/stunnel/stunnel.conf
[.] UTF-8 byte order mark not detected
[ ] Compression disabled
[ ] No PRNG seeding was required
[ ] Initializing service [Google Auth Test]
[ ] Initializing context [Google Auth Test]
[ ] stunnel default security level set: 2
[ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK
[ ] TLSv1.3 ciphersuites: TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256
[ ] TLS options: 0x2100000 (+0x0, -0x0)
[ ] Session resumption enabled
[ ] Loading certificate from file: /usr/local/etc/stunnel/stunnel.pem
[ ] Certificate loaded from file: /usr/local/etc/stunnel/stunnel.pem
[ ] Loading private key from file: /usr/local/etc/stunnel/stunnel.pem
[ ] Private key loaded from file: /usr/local/etc/stunnel/stunnel.pem
[ ] Private key check succeeded
[ ] No trusted certificates found
[:] Service [Google Auth Test] needs authentication to prevent MITM attacks
[ ] OCSP: Client OCSP stapling enabled
[ ] DH initialization skipped: client section
[ ] ECDH initialization
[ ] ECDH initialized with curves X25519:P-256:X448:P-521:P-384
[.] Configuration successful
[ ] Deallocating deployed section defaults
[ ] Cleaning up context [stunnel]
[ ] Binding service [Google Auth Test]
[ ] Listening file descriptor created (FD=9)
[ ] Setting accept socket options (FD=9)
[ ] Option SO_REUSEADDR set on accept socket
[.] Binding service [Google Auth Test] to 127.0.0.1:1636: Address already in use (48)
[!] Binding service [Google Auth Test] failed
[ ] Unbinding service [Google Auth Test]
[ ] Service [Google Auth Test] closed
[ ] Deallocating deployed section defaults
[ ] Cleaning up context [stunnel]
[ ] Deallocating section [Google Auth Test]
[ ] Cleaning up context [Google Auth Test]
[ ] Initializing inetd mode configuration
There you see it fails to start for me because it's already running.