Email send fails / SMTP Certificate

[#1]

---

@Dalesman wrote:

I don't pretend to understand it fully - it seemed earlier to be a problem with phones being out of manufacturers' support, but I guess that wasn't the cause. Or maybe it was.

...

In any case, it's working again. For now.

---

It is indeed related directly to the phones being out of support / not receiving security updates from their vendors.

The issue arises from the utilisation of updated (better?) root certificates in the SSL certificate validation chain; if vendors have not supplied the updated root certificates to the devices, those devices cannot verify SSL certificates signed with current root certificate standards.

Plusnet's mitigation (which I chased) has regressed the SMTP root certificate signature to be that the same as that used for the inbound servers.  The inbound and outbound servers were using different root certificate standards ... which is why only outbound was impacted.

Indeed it is working for now ... but for how long is a moot point.  Make no mistake, the issue here is obsolescence of perfectly good functional hardware all for the sake of maintaining a security update service on mature products.  We have been able to facilitate a fix within the Plusnet space for the SMTP server SSL update.  Be assured, you will encounter this again with other service providers as they harden their SSL certificates ... and they might not be so willing to accommodate mature devices whose security profile is not compatible with current standards.

Your appropriate avenues to address these issues is to lobby your vendor to get their finger out to release updated SSL root certificates to the mature product user base.  I note that Apple did this recently, IIRC all the way back to iOS12.

[#2]

@Townman 

You say Your appropriate avenues to address these issues is to lobby your vendor to get their finger out to release updated SSL root certificates to the mature product user base.

Would "Vendor" in this context be the manufacturer of the phone, or the mobile network provider?

I still receive regular updates for my 8 year old Huawei P20 so I am surprised that I am having this problem.

[#3]

Yes, the Huawei P20 vendor.

Doing a bit of Google research, it appears that is an Android 10 device...

AI Mode conversation: What SSL root certificate versions have been issued to Huawei P20 devices

You said: What SSL root certificate versions have been issued to Huawei P20 devices

What SSL root certificate versions have been issued to Huawei P20 devices

Huawei P20 devices do not receive unique, individual SSL root certificate versions. Instead, like all Android smartphones, they come equipped with a built-in, read-only system trusted root certificate store that is dictated entirely by the device's operating system version. [1, 2]

The Huawei P20 series originally launched running Android 8.1 Oreo (EMUI 8.1) and was officially updated up to Android 10 (EMUI 10). Consequently, the SSL root certificates trusted by a Huawei P20 are the standard ones bundled into the Google/Android open-source trust stores for Android versions 8.1 through 10. [1]

How to View the Exact List on Your Device

Because root stores can slightly vary by regional firmware updates, you can inspect the exact active versions and CAs on your specific Huawei P20: [1]

1. Open the Settings app.
2. Navigate to Security & Privacy > More security settings.
3. Tap Encryption and credentials.
4. Select Trusted credentials. [1]

Under the System tab, you will see the full cryptographic inventory of every SSL root certificate currently active on the hardware. [1]

Limitations on Updates

Because the Huawei P20 runs Android 10, its system root store is frozen within the system partition. Unlike Android 14 (which allows Google Play Services to update root certificates independently), any expired root certificates on the P20 cannot be updated automatically unless Huawei pushes a rare over-the-air (OTA) system update. Users or network administrators who require newer root certificates must manually install them under the User credential store. [1, 2, 3, 4]

DigiCert is actively migrating its go-forward public TLS hierarchy to the DigiCert G5 Root. Because the Huawei P20 is stuck on Android 10, its hardcoded, read-only system trust store was compiled years before the G5 root hierarchy became widely distributed or cross-signed on older Android firmware.

3. If You Are an End-User (On the Huawei P20)

If you are simply trying to get an app or website to load on your phone, you must install the G5 root certificate into your user credential store: [1]

1. Using your mobile browser, navigate to the official DigiCert Root Certificates Trusted Resource and download the DigiCert TLS RSA4096 Root G5 file (typically a .crt, .pem, or .cer file).
2. Go to Settings > Security & Privacy > More security settings > Encryption and credentials.
3. Tap Install from storage (or Install a certificate > CA Certificate).
4. Select the downloaded DigiCert G5 file and approve the installation using your lock screen PIN/fingerprint. [1]

Note: While this fixes browsers like Chrome, some strict third-party apps explicitly block or ignore user-installed certificates for security reasons, meaning an app-level or server-level fix remains the ultimate solution. [1, 2]

Hope that helps.

[#4]

@Townman 

Well Outlook for Android isn't sending again. Odd, because it wasn't, then it was, now it isn't again.

It's my preferred email app but a nuisance in that the settings are frozen when an account is created and can't be edited or even viewed. It appears you have to delete the account and start again. My phone is running Android 11 and I'm pretty sure it's no longer supported. 

But it's interesting that it may be possible to download the DigiCert root G5 and install it as a user.

[#5]

Oh Outlook for Android (as opposed to proper Outlook365) is yet another bag of worms.  What error message are you getting?

[#6]

@Townman 

Thanks for that. It hadn't occurred that this might be something that a mere end-user could update themselves.

I have installed the G5 certificate as per your instructions and nothing seemed to break. I can still send using SSL/TLS (but then again I could even before installing the new certificate).

Will continue to monitor.

I did notice that the last security update was June 2022 so I will see if I can raise a support ticket with Huawei.

[#7]

We have Samsung phones & tablets - the phones are running Android 8 and 12, the tablets 14 & 11.

On all we use the Samsung Mail program, using SSL/TLS to relay.force9.net.

All of them can read emails.

All of them could send emails after migration in December,  but rarely used since.

However, recently when on holiday NONE of them could send emails, which was a real problem. There was no detailed error given.

But I have just tried now, and all sends worked again to my surprise!

I had wondered if it was a certificates problem, now I am just confused.

[#8]

@Townman 

It says 'sending' followed by 'your message couldn't be sent'.

I haven't done anything with Outlook (for Android) settings since this first cropped up, because it means deleting the account and setting up a new one. Which I may have to do. I think it's a nicer UI than Gmail.

However, it was working mid-September but now it's not sending. Again.

[#9]

@mavison 

None could send email on holiday.   

Increasingly  ISP are like Orange in France and block SMTP on Port 25.

Make sure SMTP is set to work via Port 587 or 465.

@Dalesman 

relay.force9.net did have a G5 Certificate for a time, but that has recently reverted to a G1 Certificate that is fine for the older devices.     Another server we can use is mail.enmail.co that has a YR2 Certificate it also works with older kit.

[#10]

@PhilipHeyes 

I have used port 465 with SSL/TLS security to relay.force9.net for many years on all devices and email clients. I refuse to try any that are not encrypted, and have not changed because of migration.

But the mention of that relay.force9.net using a G5 certificate for a while, but now reverted back to G1, intrigues me.
Do you have any dates for those changes, and how do you display what they have?

[#11]

@mavison 

We also are mainly using relay.force9.net 465  SSL/TLS with Certificate check.

The start of this thread was when the G5 Certificates appeared & affected older kit.

Only in the last couple of days I have noticed the G1 Certificate is in place for relay.force9.net

To see the Certificate types try :  https://netoz.au/tools/mail-ssl-checker

Have a look at say :

relay.plus.net      ( different on in bound and out bound )
relay.force9.net  ( ditto )
mail.enmail.co    ( All YR2 )

[#12]

@PhilipHeyes 

Thanks for that clarification. I had not taken in the earlier parts of the thread because you said  it is not affecting Samsung Email app on Android, all are sending perfectly via relay.force9.net and it later seemed to concentrate on Apple devices.

The initial pdf has led me to checktls.com, and your reply to netoz.au - both look useful sites, and I will have read further to try and understand what the G1 & G5 certificates are.

Thanks for the info.

[#13]

@mavison 

All a learning curve.

G5 certificates did not affecting Samsung Email

on my wife's mobile with a current version of Android.  

The up to date Android being the key.

[#14]

I'm a bit confused by the information being presented here.

If the issue was the security certificate, how come neither installing the G5 certificate nor the server reverting to G1,  solved the problem for some people?

And why did the server revert to G1? Why not G4 or any of the other variants?

In other news, Huawei has told me that although my device still receives periodic updates even after 8 years, they cannot guarantee that the latest SMTP certificates will be included, which seems a bit odd but I've given up on getting any further with them.

[#15]

I realise we all may have slightly different problems, but this is getting tiresome.

My usual and preferred Android email client, Outlook, was not sending email when this thread started, then it was, now it isn't again. My backup client, Gmail, can send email (currently set to 'accept any certificate') but is not syncing - my sent box is empty.

What does the Forum suggest I do? Options to fix Outlook might be:

1. Try to download and install a G5 certificate on my OnePlus phone.

2. Since Outlook for Android does not allow access to account settings once they're set, try deleting the account and set it up again with alternative security settings, assuming there are some. What setting though?

In the case of the Gmail client, I've no idea why the sent box is empty.