Body: <p>I know there were already a lot of these issues on this board, but none solved mine, unfortunately. Be assured that I searched quite a lot (for hours) but could not solve it. I hope I have not overlooked a good answer.</p>
  <p>This post is somewhat long - I am sorry - but I did want to include some debugging-information since I guess it might be helpful in finding a solution.</p>
  <p>Thank you very much for taking the time to read and (hopefully) respond.</p>
  <p><strong>Summary</strong>: I tried to send mails (from a php script) via smtp. The site uses an external mailserver (MX mail.domain.com →  mailgate.otherdomain.com → A to external IP). When trying to send the mail, I get an error: <code>SSL routines:tls_process_server_certificate:certificate verify failed</code>. Trying to connect via SSH results in <code>Verification error: self signed certificate</code> which is true for the webserver, but not for the external mailserver. CheckTLS states: <code>Cert Hostname DOES NOT VERIFY (mailgate.wwwshort.com != localhost.localdomain)</code>. I am in charge of the webserver (managed server) but not of the mailserver (externally provided).</p>
  <h2>The Setup</h2>
  <p><strong>Website</strong> runs on <code>wwwdomain.com</code> - they also have a shorter version, let's call it <code>wwwshort.com</code></p>
  <p><strong>Mail server</strong> is provided by another company and is found on <code>mailgate.wwwshort.com</code> (this is the MX for all (wwwdomain, wwwshort, other domains) the domains. In the DNS for wwwshort.com there is an A record pointing to the IP). There is also an A record mail.* pointing to <code>mailgate.wwwshort.com</code>.</p>
  <p>I try to send emails from a craftcms3 installation via smtp. Mailserver is <code>mail.wwwdomain.com</code></p>
  <p>All domains have self-signed certificates. The server behind <code>mailgate.shortdomain.com</code> has a proper SSL certificate which also mentions all the possible domain names (e.g. mail.wwwdomain.com, mail.wwwshort.com,  mailgate.wwwshort.com etc).</p>
  <p>My client uses this mailserver daily (I guess it is an Microsoft Exchange Server) and has no problems whatsoever.</p>
  <h2>The Problem</h2>
  <p>When trying to send mails, I get the following error in my log:</p>
  <blockquote>
  <p>Error sending email: stream_socket_enable_crypto(): SSL operation
  failed with code 1. OpenSSL Error messages: error:1416F086:SSL
  routines:tls_process_server_certificate:certificate verify faile</p>
  </blockquote>
  <p>I was able (some time ago) to perform the workaround suggested <a href="https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting#php-56-certificate-verification-failure" rel="nofollow noreferrer">here</a> but I don't want to do that anymore since it is not really secure.</p>
  <h2>Troubleshooting</h2>
  <p>I set up a script using PHPMailer to get a more complete log. This was what I got:</p>
  <pre><code>2021-01-23 18:30:30 Connection: opening to mail.wwwdomain.com:587, timeout=300, options=array()
  2021-01-23 18:30:30 Connection: opened
  2021-01-23 18:30:30 SMTP INBOUND: &quot;220 mailgate.wwwshort.com ESMTP - DSS&quot;
  2021-01-23 18:30:30 SERVER -&gt; CLIENT: 220 mailgate.wwwshort.com ESMTP - DSS
  2021-01-23 18:30:30 CLIENT -&gt; SERVER: EHLO www.wwwdomain.com
  2021-01-23 18:30:30 SMTP INBOUND: &quot;250-mailgate.wwwshort.com&quot;
  2021-01-23 18:30:30 SMTP INBOUND: &quot;250-PIPELINING&quot;
  2021-01-23 18:30:30 SMTP INBOUND: &quot;250-SIZE 105080012&quot;
  2021-01-23 18:30:30 SMTP INBOUND: &quot;250-ETRN&quot;
  2021-01-23 18:30:30 SMTP INBOUND: &quot;250-STARTTLS&quot;
  2021-01-23 18:30:30 SMTP INBOUND: &quot;250-ENHANCEDSTATUSCODES&quot;
  2021-01-23 18:30:30 SMTP INBOUND: &quot;250-8BITMIME&quot;
  2021-01-23 18:30:30 SMTP INBOUND: &quot;250 DSN&quot;
  2021-01-23 18:30:30 SERVER -&gt; CLIENT: 250-mailgate.wwwshort.com250-PIPELINING250-SIZE 105080012250-ETRN250-STARTTLS250-ENHANCEDSTATUSCODES250-8BITMIME250 DSN
  2021-01-23 18:30:30 CLIENT -&gt; SERVER: STARTTLS
  2021-01-23 18:30:30 SMTP INBOUND: &quot;220 2.0.0 Ready to start TLS&quot;
  2021-01-23 18:30:30 SERVER -&gt; CLIENT: 220 2.0.0 Ready to start TLS
  2021-01-23 18:30:30 Connection failed. Error #2: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed [/usr/www/users/client/test-mail/PHPMailer/SMTP.php line 467]
  SMTP Error: Could not connect to SMTP host.
  2021-01-23 18:30:30 CLIENT -&gt; SERVER: QUIT
  2021-01-23 18:30:30 
  2021-01-23 18:30:30 
  2021-01-23 18:30:30 
  2021-01-23 18:30:30 
  2021-01-23 18:30:30 
  2021-01-23 18:30:30 Connection: closed
  SMTP Error: Could not connect to SMTP host.
  Message could not be sent. Mailer Error: SMTP Error: Could not connect to SMTP host.
  </code></pre>
  <p>Now I searched the web and did a lot of investigations. I will list the results here.</p>
  <h3>Checking CA certificates</h3>
  <p>I followed the advice from <a href="https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting#php-56-certificate-verification-failure" rel="nofollow noreferrer">PHPMailer</a> and checked the CA certs by</p>
  <pre><code>echo QUIT | openssl s_client -crlf -starttls smtp -CAfile /etc/ssl/cacert.pem -connect smtp.gmail.com:587
  </code></pre>
  <p>This worked <em>perfectly fine</em>.</p>
  <p>Now I tried the same with <code>mail.wwwdomain.com</code>:</p>
  <pre><code>echo QUIT | openssl s_client -crlf -starttls smtp -CAfile /etc/ssl/cacert.pem -connect mail.wwwdomain.com:587
  </code></pre>
  <p>Here the problem started again:</p>
  <pre><code>CONNECTED(00000003)
  depth=0 O = NA, CN = localhost.localdomain
  verify error:num=18:self signed certificate
  verify return:1
  depth=0 O = NA, CN = localhost.localdomain
  verify return:1
  ---
  Certificate chain
   0 s:O = NA, CN = localhost.localdomain
     i:O = NA, CN = localhost.localdomain
  ---
  Server certificate
  -----BEGIN CERTIFICATE-----
  MIIFMDCCAxigJANm1uWBG8V5qMA0GIb3DQEBDAUAMC0xCzAJBgNV
  BAoMAk5BMR4wHAYDDBVQub2WjAtMQswCQYDVQAJOQMBwGA1UEAww
  bG9jYWxob3N0LmxvY2FsZG9tYWluMIICIjANBgkqhk0BAg8AMIIC (shortened)
  CgKCAgEAyXZvXtT7f
  -----END CERTIFICATE-----
  subject=O = NA, CN = localhost.localdomain
  
  issuer=O = NA, CN = localhost.localdomain
  
  ---
  No client certificate CA names sent
  Peer signing digest: SHA256
  Peer signature type: RSA
  Server Temp Key: ECDH, P-256, 256 bits
  ---
  SSL handshake has read 2481 bytes and written 483 bytes
  Verification error: self signed certificate
  ---
  New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
  Server public key is 4096 bit
  Secure Renegotiation IS supported
  Compression: NONE
  Expansion: NONE
  No ALPN negotiated
  SSL-Session:
      Protocol  : TLSv1.2
      Cipher    : ECDHE-RSA-AES256-GCM-SHA384
      Session-ID: 0225B94178B4DE0B4499DAFB0C0D3AD4BE5519CCFBA4458E1333FF56B56D700D
      Session-ID-ctx: 
      Master-Key: 103159001B6597C40E8C35A31B5DC240AE52D081BEE153A0B904A71C618D235AE5DD21192A784FBD35084130A1A36688
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      TLS session ticket lifetime hint: 7200 (seconds)
      TLS session ticket:
      0000 - 71 f2 0b 8f 85 4b e2 9a-cb bc 21 1f 5a c6 a7 b4   q....K....!.Z...
      (shortened)
  
      Start Time: 1611427542
      Timeout   : 7200 (sec)
      Verify return code: 18 (self signed certificate)
      Extended master secret: yes
  ---
  250 DSN
  DONE
  </code></pre>
  <p>The output was equal for <code>mailgate.wwwshort.com</code> and the IP-Adress of the Mailserver.</p>
  <p>Two things caught my attention:</p>
  <pre><code>SSL handshake has read 2481 bytes and written 483 bytes
  Verification error: self signed certificate
  </code></pre>
  <p>and the mentioning of localhost.local</p>
  <pre><code>0 s:O = NA, CN = localhost.localdomain
    i:O = NA, CN = localhost.localdomain
  </code></pre>
  <h3>SSL Report</h3>
  <p>I used the <a href="https://www.ssllabs.com/ssltest/analyze.html" rel="nofollow noreferrer">SSL Report</a> from SSL Labs to test the domains.</p>
  <ul>
  <li><code>wwwlong.com</code> was correctly recognized as &quot;self-signed&quot; and lists only the main domain and www.* It got an B rating.</li>
  <li><code>wwwshort.com</code> also</li>
  <li><code>mail.wwwdomain.com</code> was correctly recognized as not-self-signed and listed as &quot;alternative names&quot; all the other possible domains pointing to this server. It got an A+ rating.</li>
  </ul>
  <h3>Check-TLS</h3>
  <p>I used <a href="https://www.checktls.com/TestReceiver" rel="nofollow noreferrer">CheckTLS</a> to run some tests on <code>wwwdomain.com</code>. It identified the MX server correctly as <code>mailgate.wwwshort.com</code> (with correct IP) and showed the following output.</p>
  <p><a href="https://i.sstatic.net/mqmlt.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/mqmlt.png" alt="Result from CheckTLS" /></a></p>
  <pre><code>[000.000]       Trying TLS on mailgate.wwwshort.com[217.86.144.15:25] (10)
  [000.099]       Server answered
  [000.595]   &lt;‑‑ 220 mailgate.wwwshort.com ESMTP - DSS
  [000.595]       We are allowed to connect
  [000.595]   ‑‑&gt; EHLO www12-do.checktls.com
  [000.691]   &lt;‑‑ 250-mailgate.wwwshort.com
                  250-PIPELINING
                  250-SIZE 105080012
                  250-ETRN
                  250-STARTTLS
                  250-AUTH PLAIN LOGIN
                  250-ENHANCEDSTATUSCODES
                  250-8BITMIME
                  250 DSN
  [000.691]       We can use this server
  [000.691]       TLS is an option on this server
  [000.692]   ‑‑&gt; STARTTLS
  [000.788]   &lt;‑‑ 220 2.0.0 Ready to start TLS
  [000.788]       STARTTLS command works on this server
  [001.010]       Connection converted to SSL
  SSLVersion in use: TLSv1_2
  Cipher in use: ECDHE-RSA-AES256-GCM-SHA384
  Perfect Forward Secrecy: yes
  Certificate #1 of 1 (sent by MX):
  Cert VALIDATION ERROR(S): self signed certificate
  So email is encrypted but the recipient domain is not verified
  Cert Hostname DOES NOT VERIFY (mailgate.wwwshort.com != localhost.localdomain)
  So email is encrypted but the host is not verified
  Not Valid Before: Jan  9 20:31:46 2021 GMT
  Not Valid After: Oct  6 20:31:46 2023 GMT
  subject= /O=NA/CN=localhost.localdomain
  issuer= /O=NA/CN=localhost.localdomain
  [001.013]   ~~&gt; EHLO www12-do.checktls.com
  [001.111]   &lt;~~ 250-mailgate.wwwshort.com
  250-PIPELINING
  250-SIZE 105080012
  250-ETRN
  250-AUTH PLAIN LOGIN
  250-ENHANCEDSTATUSCODES
  250-8BITMIME
  250 DSN
  [001.111]       TLS successfully started on this server
  [001.111]   ~~&gt; MAIL FROM:&lt;test@checktls.com&gt;
  [001.212]   &lt;~~ 250 2.1.0 Ok
  [001.212]       Sender is OK
  [001.212]   ~~&gt; QUIT
  [001.311]   &lt;~~ 221 2.0.0 Bye
  </code></pre>
  <p>Highlighted was this part:</p>
  <pre><code>Certificate #1 of 1 (sent by MX):
  Cert VALIDATION ERROR(S): self signed certificate
  So email is encrypted but the recipient domain is not verified
  Cert Hostname DOES NOT VERIFY (mailgate.wwwshort.com != localhost.localdomain)
  So email is encrypted but the host is not verified
  </code></pre>
  <p>I wondered whether the self-signed certificate of the webserver caused the problem (since it was a wildcard *.wwwdomain.com initially) so I replaced all the certificates with self-signed ones that only include the main domain. However, the problem persists (although I am not sure whether I just have to wait longer).</p>
  <h2>My &quot;not-understanding&quot;</h2>
  <p>To my (not)understanding there are reports on two problems: 1) the certificate is <strong>self signed</strong> (which is true for the webserver,but not for the mailserver) and 2) the <strong>domain names don't match up</strong>.</p>
  <p>I am absolutely not an expert on all this. Can anyone tell me whether the problem is on my side (webserver, craft, etc.) or on &quot;their side&quot; (mailserver).</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-01-25T00:29:49.183Z
Comments.Text: What are your craft cms email settings in the CP? SMTP? It looks like you’re trying to send email via SSL but since origin server is self signed it’s failing validation. You may consider changing ports and seeing if that would work.
Comments.UserDisplayName: RitterKnight
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-01-25T20:05:57.920Z
Comments.Text: Thank you for your answer.
  
  An answer I got on a different board caused me to look deeper into the certificate of the mailserver. I did some tests and found, that the domain `mailgate.wwwshort.com` is not included in the certificate of the mail server (just `mail.wwwdomain.com`). With this information I contacted the company about the issue. I hope they will resolve this and I will update this post accordingly.
Comments.UserDisplayName: Luke
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-01-26T14:16:13.893Z
Comments.Text: Voting to close this because it's not Craft CMS related.
Comments.UserDisplayName: RitterKnight
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-01-27T15:45:10.963Z
Comments.Text: Agree. Turned out it (probably) is not craft related.
Comments.UserDisplayName: Luke
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-01-31T19:06:15.843Z
Comments.Text: I am now two steps further and have a question that relates more to Craft. I am not sure whether it is better to start this as a new topic or not.
  
  The certificate of the mailserver is now correct with the same hostname. However, it is still a self-signed certificate. I know I can set a parameter to accept self-signed certificates. But I do not know how to set this in Craft. I had a solution for an older version of Craftcms, however, this is not supporting right now. 
  
  Can anyone help?
Comments.UserDisplayName: Luke
Tags: <emails><server><security><ssl>
Title: Certificate problems when sending mail via smpt (tream_socket_enable_crypto(): SSL operation failed with code 1)
ThreadText: # Certificate problems when sending mail via smpt (tream_socket_enable_crypto(): SSL operation failed with code 1)
  
  (Asked by: username_0 on 2021-01-23)
  
  I know there were already a lot of these issues on this board, but none solved mine, unfortunately. Be assured that I searched quite a lot (for hours) but could not solve it. I hope I have not overlooked a good answer.
  
  This post is somewhat long - I am sorry - but I did want to include some debugging-information since I guess it might be helpful in finding a solution.
  
  Thank you very much for taking the time to read and (hopefully) respond.
  
  **Summary**: I tried to send mails (from a php script) via smtp. The site uses an external mailserver (MX mail.domain.com → mailgate.otherdomain.com → A to external IP). When trying to send the mail, I get an error: `SSL routines:tls_process_server_certificate:certificate verify failed`. Trying to connect via SSH results in `Verification error: self signed certificate` which is true for the webserver, but not for the external mailserver. CheckTLS states: `Cert Hostname DOES NOT VERIFY (mailgate.wwwshort.com != localhost.localdomain)`. I am in charge of the webserver (managed server) but not of the mailserver (externally provided).
  
  ## The Setup
  
  **Website** runs on `wwwdomain.com` - they also have a shorter version, let's call it `wwwshort.com`
  
  **Mail server** is provided by another company and is found on `mailgate.wwwshort.com` (this is the MX for all (wwwdomain, wwwshort, other domains) the domains. In the DNS for wwwshort.com there is an A record pointing to the IP). There is also an A record mail.\* pointing to `mailgate.wwwshort.com`.
  
  I try to send emails from a craftcms3 installation via smtp. Mailserver is `mail.wwwdomain.com`
  
  All domains have self-signed certificates. The server behind `mailgate.shortdomain.com` has a proper SSL certificate which also mentions all the possible domain names (e.g. mail.wwwdomain.com, mail.wwwshort.com, mailgate.wwwshort.com etc).
  
  My client uses this mailserver daily (I guess it is an Microsoft Exchange Server) and has no problems whatsoever.
  
  ## The Problem
  
  When trying to send mails, I get the following error in my log:
  
  > Error sending email: stream\_socket\_enable\_crypto(): SSL operation
  > failed with code 1. OpenSSL Error messages: error:1416F086:SSL
  > routines:tls\_process\_server\_certificate:certificate verify faile
  
  I was able (some time ago) to perform the workaround suggested [here](https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting#php-56-certificate-verification-failure) but I don't want to do that anymore since it is not really secure.
  
  ## Troubleshooting
  
  I set up a script using PHPMailer to get a more complete log. This was what I got:
  
  ```
  2021-01-23 18:30:30 Connection: opening to mail.wwwdomain.com:587, timeout=300, options=array()
  2021-01-23 18:30:30 Connection: opened
  2021-01-23 18:30:30 SMTP INBOUND: "220 mailgate.wwwshort.com ESMTP - DSS"
  2021-01-23 18:30:30 SERVER -> CLIENT: 220 mailgate.wwwshort.com ESMTP - DSS
  2021-01-23 18:30:30 CLIENT -> SERVER: EHLO www.wwwdomain.com
  2021-01-23 18:30:30 SMTP INBOUND: "250-mailgate.wwwshort.com"
  2021-01-23 18:30:30 SMTP INBOUND: "250-PIPELINING"
  2021-01-23 18:30:30 SMTP INBOUND: "250-SIZE 105080012"
  2021-01-23 18:30:30 SMTP INBOUND: "250-ETRN"
  2021-01-23 18:30:30 SMTP INBOUND: "250-STARTTLS"
  2021-01-23 18:30:30 SMTP INBOUND: "250-ENHANCEDSTATUSCODES"
  2021-01-23 18:30:30 SMTP INBOUND: "250-8BITMIME"
  2021-01-23 18:30:30 SMTP INBOUND: "250 DSN"
  2021-01-23 18:30:30 SERVER -> CLIENT: 250-mailgate.wwwshort.com250-PIPELINING250-SIZE 105080012250-ETRN250-STARTTLS250-ENHANCEDSTATUSCODES250-8BITMIME250 DSN
  2021-01-23 18:30:30 CLIENT -> SERVER: STARTTLS
  2021-01-23 18:30:30 SMTP INBOUND: "220 2.0.0 Ready to start TLS"
  2021-01-23 18:30:30 SERVER -> CLIENT: 220 2.0.0 Ready to start TLS
  2021-01-23 18:30:30 Connection failed. Error #2: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed [/usr/www/users/client/test-mail/PHPMailer/SMTP.php line 467]
  SMTP Error: Could not connect to SMTP host.
  2021-01-23 18:30:30 CLIENT -> SERVER: QUIT
  2021-01-23 18:30:30 
  2021-01-23 18:30:30 
  2021-01-23 18:30:30 
  2021-01-23 18:30:30 
  2021-01-23 18:30:30 
  2021-01-23 18:30:30 Connection: closed
  SMTP Error: Could not connect to SMTP host.
  Message could not be sent. Mailer Error: SMTP Error: Could not connect to SMTP host.
  
  ```
  
  Now I searched the web and did a lot of investigations. I will list the results here.
  
  ### Checking CA certificates
  
  I followed the advice from [PHPMailer](https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting#php-56-certificate-verification-failure) and checked the CA certs by
  
  ```
  echo QUIT | openssl s_client -crlf -starttls smtp -CAfile /etc/ssl/cacert.pem -connect smtp.gmail.com:587
  
  ```
  
  This worked *perfectly fine*.
  
  Now I tried the same with `mail.wwwdomain.com`:
  
  ```
  echo QUIT | openssl s_client -crlf -starttls smtp -CAfile /etc/ssl/cacert.pem -connect mail.wwwdomain.com:587
  
  ```
  
  Here the problem started again:
  
  ```
  CONNECTED(00000003)
  depth=0 O = NA, CN = localhost.localdomain
  verify error:num=18:self signed certificate
  verify return:1
  depth=0 O = NA, CN = localhost.localdomain
  verify return:1
  ---
  Certificate chain
   0 s:O = NA, CN = localhost.localdomain
     i:O = NA, CN = localhost.localdomain
  ---
  Server certificate
  -----BEGIN CERTIFICATE-----
  MIIFMDCCAxigJANm1uWBG8V5qMA0GIb3DQEBDAUAMC0xCzAJBgNV
  BAoMAk5BMR4wHAYDDBVQub2WjAtMQswCQYDVQAJOQMBwGA1UEAww
  bG9jYWxob3N0LmxvY2FsZG9tYWluMIICIjANBgkqhk0BAg8AMIIC (shortened)
  CgKCAgEAyXZvXtT7f
  -----END CERTIFICATE-----
  subject=O = NA, CN = localhost.localdomain
  
  issuer=O = NA, CN = localhost.localdomain
  
  ---
  No client certificate CA names sent
  Peer signing digest: SHA256
  Peer signature type: RSA
  Server Temp Key: ECDH, P-256, 256 bits
  ---
  SSL handshake has read 2481 bytes and written 483 bytes
  Verification error: self signed certificate
  ---
  New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
  Server public key is 4096 bit
  Secure Renegotiation IS supported
  Compression: NONE
  Expansion: NONE
  No ALPN negotiated
  SSL-Session:
      Protocol  : TLSv1.2
      Cipher    : ECDHE-RSA-AES256-GCM-SHA384
      Session-ID: 0225B94178B4DE0B4499DAFB0C0D3AD4BE5519CCFBA4458E1333FF56B56D700D
      Session-ID-ctx: 
      Master-Key: 103159001B6597C40E8C35A31B5DC240AE52D081BEE153A0B904A71C618D235AE5DD21192A784FBD35084130A1A36688
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      TLS session ticket lifetime hint: 7200 (seconds)
      TLS session ticket:
      0000 - 71 f2 0b 8f 85 4b e2 9a-cb bc 21 1f 5a c6 a7 b4   q....K....!.Z...
      (shortened)
  
      Start Time: 1611427542
      Timeout   : 7200 (sec)
      Verify return code: 18 (self signed certificate)
      Extended master secret: yes
  ---
  250 DSN
  DONE
  
  ```
  
  The output was equal for `mailgate.wwwshort.com` and the IP-Adress of the Mailserver.
  
  Two things caught my attention:
  
  ```
  SSL handshake has read 2481 bytes and written 483 bytes
  Verification error: self signed certificate
  
  ```
  
  and the mentioning of localhost.local
  
  ```
  0 s:O = NA, CN = localhost.localdomain
    i:O = NA, CN = localhost.localdomain
  
  ```
  
  ### SSL Report
  
  I used the [SSL Report](https://www.ssllabs.com/ssltest/analyze.html) from SSL Labs to test the domains.
  
  * `wwwlong.com` was correctly recognized as "self-signed" and lists only the main domain and www.\* It got an B rating.
  * `wwwshort.com` also
  * `mail.wwwdomain.com` was correctly recognized as not-self-signed and listed as "alternative names" all the other possible domains pointing to this server. It got an A+ rating.
  
  ### Check-TLS
  
  I used [CheckTLS](https://www.checktls.com/TestReceiver) to run some tests on `wwwdomain.com`. It identified the MX server correctly as `mailgate.wwwshort.com` (with correct IP) and showed the following output.
  
  [![Result from CheckTLS](https://i.sstatic.net/mqmlt.png)](https://i.sstatic.net/mqmlt.png)
  
  ```
  [000.000]       Trying TLS on mailgate.wwwshort.com[217.86.144.15:25] (10)
  [000.099]       Server answered
  [000.595]   <‑‑ 220 mailgate.wwwshort.com ESMTP - DSS
  [000.595]       We are allowed to connect
  [000.595]   ‑‑> EHLO www12-do.checktls.com
  [000.691]   <‑‑ 250-mailgate.wwwshort.com
                  250-PIPELINING
                  250-SIZE 105080012
                  250-ETRN
                  250-STARTTLS
                  250-AUTH PLAIN LOGIN
                  250-ENHANCEDSTATUSCODES
                  250-8BITMIME
                  250 DSN
  [000.691]       We can use this server
  [000.691]       TLS is an option on this server
  [000.692]   ‑‑> STARTTLS
  [000.788]   <‑‑ 220 2.0.0 Ready to start TLS
  [000.788]       STARTTLS command works on this server
  [001.010]       Connection converted to SSL
  SSLVersion in use: TLSv1_2
  Cipher in use: ECDHE-RSA-AES256-GCM-SHA384
  Perfect Forward Secrecy: yes
  Certificate #1 of 1 (sent by MX):
  Cert VALIDATION ERROR(S): self signed certificate
  So email is encrypted but the recipient domain is not verified
  Cert Hostname DOES NOT VERIFY (mailgate.wwwshort.com != localhost.localdomain)
  So email is encrypted but the host is not verified
  Not Valid Before: Jan  9 20:31:46 2021 GMT
  Not Valid After: Oct  6 20:31:46 2023 GMT
  subject= /O=NA/CN=localhost.localdomain
  issuer= /O=NA/CN=localhost.localdomain
  [001.013]   ~~> EHLO www12-do.checktls.com
  [001.111]   <~~ 250-mailgate.wwwshort.com
  250-PIPELINING
  250-SIZE 105080012
  250-ETRN
  250-AUTH PLAIN LOGIN
  250-ENHANCEDSTATUSCODES
  250-8BITMIME
  250 DSN
  [001.111]       TLS successfully started on this server
  [001.111]   ~~> MAIL FROM:<test@checktls.com>
  [001.212]   <~~ 250 2.1.0 Ok
  [001.212]       Sender is OK
  [001.212]   ~~> QUIT
  [001.311]   <~~ 221 2.0.0 Bye
  
  ```
  
  Highlighted was this part:
  
  ```
  Certificate #1 of 1 (sent by MX):
  Cert VALIDATION ERROR(S): self signed certificate
  So email is encrypted but the recipient domain is not verified
  Cert Hostname DOES NOT VERIFY (mailgate.wwwshort.com != localhost.localdomain)
  So email is encrypted but the host is not verified
  
  ```
  
  I wondered whether the self-signed certificate of the webserver caused the problem (since it was a wildcard \*.wwwdomain.com initially) so I replaced all the certificates with self-signed ones that only include the main domain. However, the problem persists (although I am not sure whether I just have to wait longer).
  
  ## My "not-understanding"
  
  To my (not)understanding there are reports on two problems: 1) the certificate is **self signed** (which is true for the webserver,but not for the mailserver) and 2) the **domain names don't match up**.
  
  I am absolutely not an expert on all this. Can anyone tell me whether the problem is on my side (webserver, craft, etc.) or on "their side" (mailserver).
  
  **Tags:** emails, server, security, ssl
  
  > **Comments:**
  > **username_1**: What are your craft cms email settings in the CP? SMTP? It looks like you’re trying to send email via SSL but since origin server is self signed it’s failing validation. You may consider changing ports and seeing if that would work.  
  > **username_0**: Thank you for your answer.  An answer I got on a different board caused me to look deeper into the certificate of the mailserver. I did some tests and found, that the domain `mailgate.wwwshort.com` is not included in the certificate of the mail server (just `mail.wwwdomain.com`). With this information I contacted the company about the issue. I hope they will resolve this and I will update this post accordingly.  
  > **username_1**: Voting to close this because it's not Craft CMS related.  
  > **username_0**: Agree. Turned out it (probably) is not craft related.  
  > **username_0**: I am now two steps further and have a question that relates more to Craft. I am not sure whether it is better to start this as a new topic or not.  The certificate of the mailserver is now correct with the same hostname. However, it is still a self-signed certificate. I know I can set a parameter to accept self-signed certificates. But I do not know how to set this in Craft. I had a solution for an older version of Craftcms, however, this is not supporting right now.   Can anyone help?  
  
  ---
  
  ## 0 answers
  
  