topic Re: Email send fails / SMTP Certificate in Email

Email send fails / SMTP Certificate

PhilipHeyes — Thu, 20 Aug 2026 07:52:45 GMT

Are you are seeing email setup or send issues that come out out of the blue . . .

I am seeing an SMTP Certificate rejection with Blue Mail app on Android when Certificate Check is enabled for either STARTTLS ( 587 ) or SMTPS ( 465 ). Sadly I am not getting any detailed explanation.

The Certificate rejection by Blue Mail occurs on the following SMTP servers that all appear to share
the Plusnet Certificate of relay.plus.net ( see CheckTLS attached ) :

Plusnet hosted relay.plus.net

Greenby hosted relay.force9.net |

Greenby hosted relay.metronet.co.uk

Greenby relay.metronet.co.uk is also named on this Certificate, but not affected, it lacks STARTTLS & SMTPS.

I was about to raise Greenby Ticket on this, but the issue does not affect versions MS Outlook or Thunderbird installed on MS Windows and it is not affecting Samsung Email app on Android, all are sending perfectly via relay.force9.net

My workaround is to use SMTP mail.enmail.co i.e. to avoid a Certificate that was issued to Plusnet & with this I am back in business with Blue Mail. Other options may be to disable Certificate check or Disable encryption, if permitted.

Quite a puzzle, what has worked well with relay.force9.net for 6+ months has ground to a halt in just one app.

email

IanfLowe — Wed, 19 Aug 2026 20:00:29 GMT

Out going emails stopped working on iPad incoming ok

Re: email

MisterW — Thu, 20 Aug 2026 06:13:06 GMT

@IanfLowe

Do you still have broadband with Plusnet ? or have you been moved to EE or moved to another ISP yourself ?

Re: email

IanfLowe — Thu, 20 Aug 2026 09:09:22 GMT

I have been told I will be moving to Greenby but that hasn't happened as yet.

My wife's email is still working on here iPhone though, but only when wifi is available for some reason.

I noticed looking at her settings that there may be an issue with the certificate but the certificate looked to be in date.

Re: Email send fails / SMTP Certificate

MisterW — Thu, 20 Aug 2026 10:18:54 GMT

Is it a missing intermediate certificate ?

Re: Email send fails / SMTP Certificate

PhilipHeyes — Thu, 20 Aug 2026 10:44:26 GMT

The start of the 2nd Certificate is obscured by the page header in the PDF.

Certificate #2 of 3 (sent by MX):
Cert VALIDATED: ok
cert not revoked by OCSP

Data:

Version: 3 (0x2)

Serial Number: 0e:a7:1a:b4:b9:b3:0f:67:f5:a6:e6:31:76:9d:ce:9c

Validity:

Not Before: May 26 00:00:00 2022 GMT

Not After: May 25 23:59:59 2032 GMT

Re: Email send fails / SMTP Certificate

MisterW — Thu, 20 Aug 2026 11:01:56 GMT

Not my area of expertise, but Yes, the certificate chain is correct but AIUI devices store root & intermediate certificates in their certificate store.

The fact that some devices work and some don't MIGHT indicate that the device that fails doesnt have one of the root/intermediate certs in its store and so cant completely validate the certificate chain

Re: Email send fails / SMTP Certificate

PhilipHeyes — Thu, 20 Aug 2026 11:20:47 GMT

I emailed a detailed question to Blue Mail support.

The bit that looks to have changed in my environment is the last update for Blue Mail app was on 15th of this month.

Re: Email send fails / SMTP Certificate

Townman — Thu, 20 Aug 2026 17:31:18 GMT

@plusnettony

Is this connected to the same issue we saw (IIRC) about 12 months ago when the certificates were renewed with root certificate which inhibited access by mature products whose vendors have not issued certificate updates.

i have a vague recollection that a date around now is a tad critical. I’ll try to check back in my records when back at my desk…

Re: Email send fails / SMTP Certificate

Mav — Fri, 21 Aug 2026 02:40:39 GMT

Moderator's note(s):

Two threads merged.

In the process one post by @PhilipHeyes removed as it looped back to this thread from the moved one.

Re: Email send fails / SMTP Certificate

Dalesman — Fri, 21 Aug 2026 07:14:14 GMT

Thanks for merging, I spotted this similar thread too late.
Anything further on this? Is there a fix? It appears to be a certificate/security issue but what is the recommended setting?

Re: Email send fails / SMTP Certificate

PhilipHeyes — Fri, 21 Aug 2026 08:49:35 GMT

A recent thread with photos of an iPad giving Certificate error on relay.plus.net

https://community.plus.net/t5/Email/Emails-won-t-send-with-SSL-enabled-from-iPad/m-p/2055046

Re: Email send fails / SMTP Certificate

Townman — Fri, 21 Aug 2026 09:02:05 GMT

@plusnettony / @dave / @James_B

Looking back at my email history, I can confirm that new SSL certificates were issued sometime around the 15th August 2025 which had root certificates which obsolesced mature devices whose manufacturers have not updated the root certificates to the current standard.

The SSL certificates were reissued with (AIUI) secondary fall-back root certificates made acceptable. Is this the same issue - one between the business correctly seeking to use current root certificate standards whilst device manufactures are not supporting their users by not updating their devices with current root security certificates?

Re: Email send fails / SMTP Certificate

PhilipHeyes — Fri, 21 Aug 2026 09:03:21 GMT

Attached is a long rejection message captured from Gmail attempting to use relay.force9.net

Note the attached error names relay.plus.net it begins ....

Certificate not trusted

Subject: relay.plus.net

Issuer: GeoTrust G5 TLS RSA4096 SHA384 2022 CA1

Valid from: Aug 3, 2026

Expires on: Feb 17, 2027

Current date: Aug 21, 2026

Re: Email send fails / SMTP Certificate

Townman — Fri, 21 Aug 2026 12:42:02 GMT

@PhilipHeyes

That is a really good pointer.

@plusnettony / @dave / @James_B

Doing some digging...

IMAP / MAIL are using the following certificate...

Issuer:C=US, O=DigiCert Inc, CN=GeoTrust EV RSA CA G2
Version:2
Serial Number:01:85:0f:1f:f2:c6:dd:8c:2e:2c:6b:e8:10:a9:cc:b2:
Signature Algorithm:sha256WithRSAEncryption
Start Date:2026-08-03 00:00:00 GMT
Expire Date:2027-02-17 23:59:59 GMT

Subject:C=US, O=DigiCert Inc, CN=GeoTrust EV RSA CA G2
Issuer:C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
Version:2
Serial Number:0d:60:12:62:c8:a7:72:1a:6e:ab:03:61:e5:61:95:80:
Signature Algorithm:sha256WithRSAEncryption
Start Date:2020-07-02 12:42:57 GMT
Expire Date:2030-07-02 12:42:57 GMT

Whereas the SMTP server uses...

Subject:1.3.6.1.4.1.311.60.2.1.3=GB, 2.5.4.15=Private Organization, serialNumber=03279013, C=GB, L=Sheffield, O=Plusnet plc, CN=relay.plus.net
Issuer:C=US, O=DigiCert, Inc., CN=GeoTrust G5 TLS RSA4096 SHA384 2022 CA1
Version:2
Serial Number:03:4d:07:ec:4a:2c:58:e2:a3:66:8d:1c:31:7e:01:23:
Signature Algorithm:sha384WithRSAEncryption
Start Date:2026-08-03 00:00:00 GMT
Expire Date:2027-02-17 23:59:59 GMT

Subject:C=US, O=DigiCert, Inc., CN=GeoTrust G5 TLS RSA4096 SHA384 2022 CA1
Issuer:C=US, O=DigiCert, Inc., CN=DigiCert TLS RSA4096 Root G5
Version:2
Serial Number:0e:a7:1a:b4:b9:b3:0f:67:f5:a6:e6:31:76:9d:ce:9c:
Signature Algorithm:sha384WithRSAEncryption
Start Date:2022-05-26 00:00:00 GMT
Expire Date:2032-05-25 23:59:59 GMT

It looks as though the SSL certificates were renewed recently (which is not the same as being deployed) and like last year, the SMTP certificate was built (erroneously ?) with a G5 root certificate with no G2 fallback.

Legacy devices, not maintained by their vendors have a fair chance of not having G5 root certificates. This matches exactly the email history of 15th August 2025 with the head of BT Consumer Division.

Re: Email send fails / SMTP Certificate

James_B — Fri, 21 Aug 2026 12:46:50 GMT

Thanks all - we've flagged this for investigation.

James

Re: Email send fails / SMTP Certificate

Dalesman — Fri, 21 Aug 2026 16:14:29 GMT

So, if I've understood, the phone being out of support from the manufacturer is the issue.
So far, I've got the Gmail app sending again but there's still a problem with synching (I think) which is resulting in the sent folder being empty and sent messages not being saved. That was done by changing to "accept all certificates", presumably including out of date ones.
My go-to email client is Outlook for Android and there I can't edit the account settings. It seems once set they can't be changed. I'll have to delete the account and try starting again.

Re: Email send fails / SMTP Certificate

PhilipHeyes — Fri, 21 Aug 2026 16:37:58 GMT

@Dalesman

If your email has migrated to Greenby try with mail server : mail.enmail.co

it works for POP3 / IMAP / SMTP & Certificate Check is passing for me in Blue Mail and Gmail.

Re: Email send fails / SMTP Certificate

Townman — Fri, 21 Aug 2026 17:28:30 GMT

@Dalesman

"So, if I've understood, the phone being out of support from the manufacturer is the issue."

Yes and No!

Yes: in that some manufactures are not updating older devices with current standard root security certificates.

No: in that Plusnet does not necessarily need to use the latest - best practice - current standard root security certificates, but it is wise to do so.

The issue has arisen due to the SSL certificates having recently been reissued; the quandary is why were inbound servers issued with G2 root certificates (which is why they still work on older devices) but outbound servers (for Plusnet / Force9 / Free-online) were issued with G5 root certificates.

@PhilipHeyes wrote:

@Dalesman

If your email has migrated to Greenby try with mail server : mail.enmail.co

Good call - that server uses a different root certificate authenticator ...

Subject:CN=mail.enmail.co
Issuer:C=US, O=Let's Encrypt, CN=YR2
Version:2
Serial Number:05:f4:33:c1:7a:9d:f2:c7:b6:e0:7a:0a:71:ba:39:fa:2d:f4:
Signature Algorithm:sha256WithRSAEncryption
Start Date:2026-08-06 14:30:19 GMT
Expire Date:2026-11-04 14:30:18 GMT

Public Key Algorithm:rsaEncryption
RSA Public Key:2048

Subject:C=US, O=Let's Encrypt, CN=YR2
Issuer:C=US, O=ISRG, CN=Root YR
Version:2
Serial Number:4e:bd:24:94:7e:24:d3:94:80:2d:84:a5:2f:d5:b3:19:
Signature Algorithm:sha256WithRSAEncryption
Start Date:2025-09-03 00:00:00 GMT
Expire Date:2028-09-02 23:59:59 GMT
Public Key Algorithm:rsaEncryption
RSA Public Key:2048

Subject:C=US, O=ISRG, CN=Root YR
Issuer:C=US, O=Internet Security Research Group, CN=ISRG Root X1
Version:2
Serial Number:00:f2:4b:6d:17:f9:d9:ad:7c:b1:c9:fe:a7:87:82:69:9f:
Signature Algorithm:sha256WithRSAEncryption
Start Date:2026-05-13 00:00:00 GMT
Expire Date:2032-09-02 23:59:59 GMT
Public Key Algorithm:rsaEncryption
RSA Public Key:4096

That looks to be allowing two root certificates to be used.

Re: Email send fails / SMTP Certificate

Townman — Fri, 21 Aug 2026 17:33:19 GMT

@James_B wrote:

Thanks all - we've flagged this for investigation.

James

Hi @James_B

What priority please and is there an ETA for investigation... This dragged on a bit last year, which is why I have the divisional escalation history. For some, this makes their mature devices not much more useful than a paper-weight.

Hard rock and sea space ... on the one hand I can understand why Plusnet might seek to drop the deprecated G2 standard and adopt something better (G5) but why do it only on the outbound server, not everywhere?

Again, we have hit this painful issue on a weekend - is this being investigated by 24/7 support staff?