Talk to our team

Documentation

✉️ Email Delivery

Documentation, reference material and tutorials for CRM-NG SMTP Email: setup guides for every mail service, troubleshooting, and one article per error message.

Error: SSL certificate verify failed

Updated

By Duane GarnerChief Executive Officer (CEO)
Summarize: Claude ChatGPT View Markdown
On this page

Your server could not trust the mail server's certificate. Use the host name on the certificate and ask your host to update its CA bundle.

Shown by the Other SMTP and Zoho Mail mailers (and the backup SMTP transport)

The test result or the error log shows a message such as stream_socket_enable_crypto(): SSL operation failed ... certificate verify failed or Misconfigured server certificate.

This article is for site owners sending through an SMTP server who see a certificate check fail during the secure connection.

What this error means

When CRM-NG SMTP opens an encrypted connection (SSL or TLS) to a mail server, it checks the server's certificate. The certificate must be valid, not expired, issued by an authority your web server trusts, and made out to the host name you connected to. "Certificate verify failed" means one of those checks did not pass, so the connection was closed before the login. This protects your password from being sent to the wrong server.

Common causes

  • SMTP Host is a name that is not on the certificate. A frequent case on shared hosting is using mail.yourdomain.com when the certificate is made out to the hosting server's own name.
  • The mail server's certificate has expired or is self-signed.
  • The certificate chain is incomplete on the mail server, so your server cannot link it to a trusted authority.
  • Your web server's list of trusted authorities (the CA bundle used by OpenSSL) is old and does not know a newer authority.
  • A firewall or antivirus on the network intercepts encrypted connections and presents its own certificate.

How to fix

  1. Find the host name on the certificate

    Ask your mail provider which SMTP server name matches its certificate. For cPanel-style hosting it is often the server's name, shown in the email account's connection settings.

  2. Check the certificate from outside

    On a computer with OpenSSL, run openssl s_client -connect smtp.example.com:465 (or add -starttls smtp with port 587) and read the subject name and expiry date.

  3. Update CRM-NG SMTP

    Go to CRM-NG SMTP → Settings → General. Enter the matching name in SMTP Host, and make sure Encryption and SMTP Port fit together: SSL with 465, TLS with 587. Save.

  4. Ask your web host to update trust

    If the certificate is valid but still rejected, ask your host to update the server's CA bundle and OpenSSL. Share the error from CRM-NG SMTP → Tools → Debug Events.

  5. Send a test

    Go to CRM-NG SMTP → Tools → Email Test, fill in Send To and press Send Email.

Verify it worked

The test page shows "Test email sent successfully! Check your inbox to confirm delivery."

Notes

  • Do not work around this by switching Encryption to None on a server that supports encryption. Your password would travel in plain text.
  • If the mail server's certificate is expired or broken, only the mail provider can fix it. Ask them, or use a different mailer meanwhile.
  • API mailers report certificate problems as cURL errors (for example 60 or 77). See the cURL articles.
Go to Top