The only mail account I have with a TLS certificate is the iCloud mail account. Others have TLS as "none".
On the idle command, this is from mail help:
Specify that the server should notify Mail when new messages are available for your Inbox. This method is known as “push email.” This option is available only for IMAP accounts.
When this option is not selected, Mail checks for new messages by connecting to and querying the server at regular intervals.
I have not yet found documentation for the TLS Certificate question. It would seem to hold the answer for the long sought-after question of Apple mail support for IMAP SSL client certificates. At present, the mailer sends an empty certificate with the IMAPS server requires a client certificate. I want the mailer to send the specified certificate, but it doesn't seem to.