Sample telnet:
# telnet 127.0.0.1 25
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 mail.collect.org ESMTP Postfix
helo test.test.com
mail from me@test.com
530 5.7.0 Must issue a STARTTLS command first
quit
221 2.0.0 Bye
Connection closed by foreign host.

sample maillog:
Jul 30 10:47:16 64bit postfix/smtpd[23078]: connect from localhost[127.0.0.1]
Jul 30 10:49:05 64bit postfix/smtpd[23078]: disconnect from localhost[127.0.0.1]

relevant main.cf lines:
smtp_use_tls = yes
smtpd_use_tls = yes
smtpd_enforce_tls = no
smtp_tls_note_starttls_offer = yes
smtpd_tls_key_file = /etc/postfix/ssl/smtpd.pem
smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.pem
smtpd_tls_CAfile = /etc/postfix/ssl/smtpd.pem
smtpd_tls_loglevel =3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtpd_sasl_auth_enable = yes
smtp_sasl_type = cyrus
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_recipient_domain, reject_unauth_destination
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_invalid_hostname, reject_non_fqdn_hostname, reject_unknown_hostname
smtp_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_maps_rbl, reject_unknown_client
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes