Posted in How To, Linux, Software, Windows

Solving “The server you are connected to is using a security certificate that could not be verified.” problem

 February 6, 2008  Leave a comment

Uff that was tough one … If you decided to make your mail communications more secure you probably switched on SSL option in your mail client for POP3/IMAP/SMTP servers. There is a good chance you will get one of those errors that sound like

The server you are connected to is using a security certificare that could not be verified.
A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
Do you want to continue using this server?

I spent way too much time solving the problem because what was just annoying message in Outlook appeared to be serious problem in MacMail. It was not capable of working correctly with that problem. In addition to that I tried to solve the problem using Plesk 8.2 that was a mistake. It appeared that whatever you do with certificates in Plesk that doesn’t affect the mail. So here is the solution for the problem:


First of all, the error message says the truth – your mail server sends to client some certificate that is not trusted by one of the major trust providers known to your OS. Is you’re using Plesk you possibly tried to fix the problem by manipulating certificates in Server->Certificates menu, but those certificates do not affect mail. It looks like they affect HTTPS access only, though I can”t confirm that.
Here is the step-by-step instruction of how to fix the situation:

  1. Obtain certificate you will use for your mail server. The certificate should be issued for the server you plan to type into the SMTP/POP3/IMAP server field in your mail client (i.e. mail server).
    1. If you want to buy one, you can use this post as a reference.
    2. If you want to generate self-signed cert using Plesk go to Server->Certificates->Add New Certificate, enter all information and click Self-Signed button.
    3. You can also generate certificate using openssl, but I’ll describe that later in a separate post. If you need it now – just google it.
  2. Generate .pem file that is a combination of CSR, Private Key, your certificate and root certificate. For self-signed certificates you will need only private key and your certificate to be in the file. To get that file in Plesk click on small blue diskette icon at the rightmost column of your certificates list. You can also create that file in a text editor – just copypaste necessary blocks one after another. Save the .pem file to your local file system. If you bougth the certificate then you can download .pem file from CA website.
  3. If you purchased your cert from a CA please skip this step. If you’re using self-signed certificate do this:
    1. Create new .crt file that contains only your certificate. In Pleask click on the certificate name to see its detals and copypaste the certificate block (including parts starting with many dashes) to a new file and save it as <somename>.crt.
    2. Import that <somename>.crt on every computer you plan to have SSL access to your mail from. Just double click on the .crt file and do whatever import dialog will tell you. In Windows XP it will tell you to import file into “trusted root servers”, so do that.
  4. Make your POP3/IMAP server use your new certificate. Plesk 8.2/8.3 uses courier-imap, so here are the update procedures for courier.
    1. Open files /etc/courier-imap/pop3d-ssl
    2. Find TLS_CERTFILE parameter. It point so a file in some directory. Most probably the dir is /usr/share/courier-imap/
    3. Upload your .pem file to that directory and modify /etc/courier-imap/pop3d-ssl so TLS_CERTFILE points to that file. You can simply overwrite the original file, just make its backup.
    4. If you use IMAP do the same with /etc/courier-imap/imapd-ssl. You can use the same file you just uploaded

  1. Make your SMTP server use your new cert. Plesk 8.2./8.3 uses qmail, so let’s patch it.
    1. Find where qmail keeps servercert.pem file on your server. Most probably it is /var/qmail/control/servercert.pem
    2. Backup the original /var/qmail/control/servercert.pem
    3. Rewrite it with your new .pem file.
  2. Restart mail system
    1. /etc/init.d/courier-imap restart
    2. /etc/init.d/qmail restart
  3. Test client. Restart your mail client, try to send/receive test email. You should not see that annoying dialog anymore.

Leave a Reply