Email send fails / SMTP Certificate

[#1]

Are you are seeing email setup or send issues that come out out of the blue . . .

I am seeing an SMTP Certificate rejection with Blue Mail app on Android when Certificate Check is enabled for either STARTTLS ( 587 ) or SMTPS ( 465 ).   Sadly I am not getting any detailed explanation.

The Certificate rejection by Blue Mail occurs on the following SMTP servers that all appear to share
the Plusnet Certificate of relay.plus.net  ( see CheckTLS attached ) :

Plusnet hosted relay.plus.net

Greenby hosted relay.force9.net |

Greenby hosted relay.metronet.co.uk

Greenby relay.metronet.co.uk is also named on this Certificate, but not affected, it lacks STARTTLS & SMTPS.

I was about to raise Greenby Ticket on this, but the issue does not affect versions MS Outlook or Thunderbird installed on MS Windows and it is not affecting Samsung Email app on Android, all are sending perfectly via relay.force9.net

My workaround is to use SMTP mail.enmail.co i.e. to avoid a Certificate that was issued to Plusnet & with this I am back in business with Blue Mail.  Other options may be to disable Certificate check or Disable encryption, if permitted.

Quite a puzzle, what has worked well with relay.force9.net for 6+ months has ground to a halt in just one app.

[#2]

Out going emails stopped working on iPad incoming ok

[#3]

@IanfLowe 

Do you still have broadband with Plusnet ? or have you been moved to EE or moved to another ISP yourself ?

[#4]

I have been told I will be moving to Greenby but that hasn't happened as yet.

My wife's email is still working on here iPhone though, but only when wifi is available for some reason.

I noticed looking at her settings that there may be an issue with the certificate but the certificate looked to be in date.

[#5]

Is it a missing intermediate certificate ? 

[#6]

The start of the 2nd Certificate is obscured by the page header in the PDF.


Certificate #2 of 3 (sent by MX):
Cert VALIDATED: ok
cert not revoked by OCSP

Data:

Version: 3 (0x2)

Serial Number: 0e:a7:1a:b4:b9:b3:0f:67:f5:a6:e6:31:76:9d:ce:9c

Validity:

Not Before: May 26 00:00:00 2022 GMT

Not After: May 25 23:59:59 2032 GMT

[#7]

Not my area of expertise, but Yes, the certificate chain is correct but AIUI devices store root & intermediate certificates in their certificate store.

The fact that some devices work and some don't MIGHT indicate that the device that fails doesnt have one of the root/intermediate certs in its store and so cant completely validate the certificate chain

[#8]

I emailed a detailed question to Blue Mail support.

The bit that looks to have changed in my environment is the last update for Blue Mail app was on 15th of this month.

[#9]

@plusnettony 

Is this connected to the same issue we saw (IIRC) about 12 months ago when the certificates were renewed with root certificate which inhibited access by mature products whose vendors have not issued certificate updates.

i have a vague recollection that a date around now is a tad critical.  I’ll try to check back in my records when back at my desk…

[#10]

Moderator's note(s):

Two threads merged.

In the process one post by @PhilipHeyes removed as it looped back to this thread from the moved one.

[#11]

Thanks for merging, I spotted this similar thread too late.
Anything further on this? Is there a fix? It appears to be a certificate/security issue but what is the recommended setting?

[#12]

A recent thread with photos of an iPad giving Certificate error on relay.plus.net 

https://community.plus.net/t5/Email/Emails-won-t-send-with-SSL-enabled-from-iPad/m-p/2055046

[#13]

@plusnettony / @dave / @James_B 

Looking back at my email history, I can confirm that new SSL certificates were issued sometime around the 15th August 2025 which had root certificates which obsolesced mature devices whose manufacturers have not updated the root certificates to the current standard.

The SSL certificates were reissued with (AIUI) secondary fall-back root certificates made acceptable.  Is this the same issue - one between the business correctly seeking to use current root certificate standards whilst device manufactures are not supporting their users by not updating their devices with current root security certificates?

[#14]

Attached is a long rejection message captured from Gmail attempting to use relay.force9.net

Note the attached error names relay.plus.net it begins ....

Certificate not trusted

Subject: relay.plus.net

Issuer: GeoTrust G5 TLS RSA4096 SHA384 2022 CA1

Valid from: Aug 3, 2026

Expires on: Feb 17, 2027

Current date: Aug 21, 2026

[#15]

@PhilipHeyes 

That is a really good pointer.

@plusnettony / @dave / @James_B 

Doing some digging...

IMAP / MAIL are using the following certificate...

Issuer:C=US, O=DigiCert Inc, CN=GeoTrust EV RSA CA G2
Version:2
Serial Number:01:85:0f:1f:f2:c6:dd:8c:2e:2c:6b:e8:10:a9:cc:b2:
Signature Algorithm:sha256WithRSAEncryption
Start Date:2026-08-03 00:00:00 GMT
Expire Date:2027-02-17 23:59:59 GMT

Subject:C=US, O=DigiCert Inc, CN=GeoTrust EV RSA CA G2
Issuer:C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
Version:2
Serial Number:0d:60:12:62:c8:a7:72:1a:6e:ab:03:61:e5:61:95:80:
Signature Algorithm:sha256WithRSAEncryption
Start Date:2020-07-02 12:42:57 GMT
Expire Date:2030-07-02 12:42:57 GMT

Whereas the SMTP server uses...

Subject:1.3.6.1.4.1.311.60.2.1.3=GB, 2.5.4.15=Private Organization, serialNumber=03279013, C=GB, L=Sheffield, O=Plusnet plc, CN=relay.plus.net
Issuer:C=US, O=DigiCert, Inc., CN=GeoTrust G5 TLS RSA4096 SHA384 2022 CA1
Version:2
Serial Number:03:4d:07:ec:4a:2c:58:e2:a3:66:8d:1c:31:7e:01:23:
Signature Algorithm:sha384WithRSAEncryption
Start Date:2026-08-03 00:00:00 GMT
Expire Date:2027-02-17 23:59:59 GMT

Subject:C=US, O=DigiCert, Inc., CN=GeoTrust G5 TLS RSA4096 SHA384 2022 CA1
Issuer:C=US, O=DigiCert, Inc., CN=DigiCert TLS RSA4096 Root G5
Version:2
Serial Number:0e:a7:1a:b4:b9:b3:0f:67:f5:a6:e6:31:76:9d:ce:9c:
Signature Algorithm:sha384WithRSAEncryption
Start Date:2022-05-26 00:00:00 GMT
Expire Date:2032-05-25 23:59:59 GMT

It looks as though the SSL certificates were renewed recently (which is not the same as being deployed) and like last year, the SMTP certificate was built (erroneously ?) with a G5 root certificate with no G2 fallback.

Legacy devices, not maintained by their vendors have a fair chance of not having G5 root certificates.  This matches exactly the email history of 15th August 2025 with the head of BT Consumer Division.