When you install Bridge, you're supposed to get a certificate in ~/.config/protonmail/bridge, but I didn't get it. I extracted it with:
openssl s_client -starttls smtp -connect 127.0.0.1:1025 -showcerts
and saved it at ~/.cert/protonmail.smtp.crt. I then had to point gnutls to it, I used the customize interface and now I have this entry in my custom.el: