# Error: SSL certificate verify failed

Source: https://catalystgroup.gg/docs/email-delivery/error-ssl-certificate-verify-failed/
Updated: 2026-10-19 · By Duane Garner

Your server could not trust the mail server's certificate. Use the host name on the certificate and ask your host to update its CA bundle.

> **Shown by the Other SMTP and Zoho Mail mailers (and the backup SMTP transport):** The test result or the error log shows a message such as `stream_socket_enable_crypto(): SSL operation failed ... certificate verify failed` or `Misconfigured server certificate`.

 

This article is for site owners sending through an SMTP server who see a certificate check fail during the secure connection.

 

## What this error means

 

When CRM-NG SMTP opens an encrypted connection (SSL or TLS) to a mail server, it checks the server's certificate. The certificate must be valid, not expired, issued by an authority your web server trusts, and made out to the host name you connected to. "Certificate verify failed" means one of those checks did not pass, so the connection was closed before the login. This protects your password from being sent to the wrong server.

 

## Common causes

 
- **SMTP Host** is a name that is not on the certificate. A frequent case on shared hosting is using `mail.yourdomain.com` when the certificate is made out to the hosting server's own name.
- The mail server's certificate has expired or is self-signed.
- The certificate chain is incomplete on the mail server, so your server cannot link it to a trusted authority.
- Your web server's list of trusted authorities (the CA bundle used by OpenSSL) is old and does not know a newer authority.
- A firewall or antivirus on the network intercepts encrypted connections and presents its own certificate.

 

## How to fix

 
1. Find the host name on the certificate
  Ask your mail provider which SMTP server name matches its certificate. For cPanel-style hosting it is often the server's name, shown in the email account's connection settings.
2. Check the certificate from outside
  On a computer with OpenSSL, run `openssl s_client -connect smtp.example.com:465` (or add `-starttls smtp` with port 587) and read the subject name and expiry date.
3. Update CRM-NG SMTP
  Go to **CRM-NG SMTP → Settings → General**. Enter the matching name in **SMTP Host**, and make sure **Encryption** and **SMTP Port** fit together: **SSL** with 465, **TLS** with 587. Save.
4. Ask your web host to update trust
  If the certificate is valid but still rejected, ask your host to update the server's CA bundle and OpenSSL. Share the error from **CRM-NG SMTP → Tools → Debug Events**.
5. Send a test
  Go to **CRM-NG SMTP → Tools → Email Test**, fill in **Send To** and press **Send Email**.

 

## Verify it worked

 

The test page shows "Test email sent successfully! Check your inbox to confirm delivery."

 

## Notes

 
- Do not work around this by switching **Encryption** to **None** on a server that supports encryption. Your password would travel in plain text.
- If the mail server's certificate is expired or broken, only the mail provider can fix it. Ask them, or use a different mailer meanwhile.
- API mailers report certificate problems as cURL errors (for example 60 or 77). See the cURL articles.

 

## Related

 
- [Other SMTP mailer guide](https://catalystgroup.gg/docs/email-delivery/mailer-other-smtp/)
- [Zoho Mail mailer guide](https://catalystgroup.gg/docs/email-delivery/mailer-zoho/)
- [Error: cURL error](https://catalystgroup.gg/docs/email-delivery/error-curl-error/)
- [Error: cURL error 77: certificate problem (Gmail)](https://catalystgroup.gg/docs/email-delivery/error-curl-error-77/)
- [Error: Could not connect to SMTP host](https://catalystgroup.gg/docs/email-delivery/error-could-not-connect-to-smtp-host/)
- [Troubleshooting email delivery](https://catalystgroup.gg/docs/email-delivery/troubleshooting/)