Mail can't verify the identity of the server 'imap.plus.net"

[#1]

@Scallywag1 

A warm welcome to the forums.

Three people, same problem all on Macs ... starting to look like a Mac environment issue.  That is out of my skill set!!  However, I would recommend looking at Apple's support forums ... and the link above.

I have tagged a member of staff here as a back stop, but I am starting to suspect that the issue is elsewhere.

[#2]

I'm wondering if it's a problem with the root certificate installed on older macOS systems. I'm running macOS Monterey (12.7.6).

@j123 I think you've hit the nail on the head there. The certificate for mail.plus.net ( and imap.plus.net ) have recently been reissued and the new chain references an updated Digicert Root certificate which is not preset in the root cert store of some older OS.

This provides some more details of which root certs are installed in various OS versions https://support.apple.com/en-gb/103272. 

It also doesnt quite explain why @Townman s IOS12 works though ? 

[#3]

Looks like there is a missing Root G5 certificate on older macOS systems.

I downloaded the DigiCert TLS RSA4096 Root G5 certificate from Digicert's website. <https://knowledge.digicert.com/general-information/digicert-trusted-root-authority-certificates#g5ro...>

I imported it into Keychain Access and changed the trust to 'Always Trust'. Quit and relaunched Mail.app, and now all is working.

[#4]

Thankyou j123! - followed your instructions and now mail is working again. 

So, is this an entirely safe way to fix this issue, or just a work-around?

[#5]

---

@MisterW wrote:

It also doesnt quite explain why @Townman s IOS12 works though ? 

---

ooops!!

But it does not - one was not looking at the right email account!!!

[#6]

@plusnettony 

On reviewing this, I find that whatever change has happened, now obsoletes my mature (but otherwise functional) iPad mini-2 running 12.5.7 which only has...

DigiCert Trusted Root G4

RSA

4096 bits

Can Plusnet's certificates be made to 'fallback' on to this prior version ... or are Plusnet's new certificates effectively obsoleting platforms for which Apple provide no certificate upgrade path?

[#7]

@Scallywag1 
I'm no expert on this, so hopefully someone more knowledgable can confirm. But as long as the certificate is from a trusted source (in this case DigiCert's own website) it should be a permanent fix.

Presumably macOS updates on later systems would include the new certificates as part of the update. On older systems, we have to download them manually.

The certificate is shown on the current list of macOS certificates that @MisterW  linked to above <https://support.apple.com/en-gb/121672>, so it is 'official'. Always check that the fingerprints match. Installing root certificates is not something to be done lightly (I've never had to do it before), but hopefully this should be a one-time fix.

@Townman 
You might be able to manually install the cert.

See <https://support.apple.com/en-gb/102390>

When I tried it just now on an iphone running iOS 15, it took a few minutes to appear in Settings. It will appear at the top level of Settings as 'Profile Downloaded'. Once installed, you need to go to Settings > General > About > Certificate Trust Settings, then slide the button to trusted.

[#8]

Presumably macOS updates on later systems would include the new certificates as part of the update. On older systems, we have to download them manually.

On Windows systems, root certificates would normally be updated as part of the Windows Update program. I would assume the same is true for current macOS systems. I would guess that older Windows systems will suffer the same problem of having to update certs manually.

[#9]

I do not see those options on iOS12.

I probably have to dig deep and find a hack from somewhere ... or go buy a new device!

[#10]

Thanks for that. We have been having the same problems since this morning, both on a newer Sonoma (M1 Max) and older MacPro 2019. 

[#11]

@Townman 
If you tap on the downloaded cert, does it give an option to install?

Maybe iOS 12 is too far back. 

[#12]

---

@j123 wrote:

Maybe iOS 12 is too far back. 

---

Possibly, since 26 (19) is due for release not much later this year, and I suspect 12 fell off the 'supported OSes' list a while back.

[#13]

This is not a Mac only issue, I'm also getting this on Android 13 using K9-Email as my mail client.

My other client, Bluemail, doesn't seem to have the same issue.

K9-email refuses to connect to IMAP.plus.net unless I explicitly trust the certificate, which I am yet to do as it's not clear why it is suddenly untrusted.

Everything looks sensible in the cert it displays (unfortunately it will not let me copy) but it does seem to use the GeoTrust G5 certificate mentioned in other posts.

[#14]

I've manually checked which root certificates are on my phone, AFAIK these are the stock ones, and I have:

DigiCert Global Root CA / G2 / G3
DigiCert AssuredID Root CA / G2 / G3
DigiCert High Assurance EV Root CA
DigiCert Trusted Root G4

There is no G5 that I can see

Has the new certificate been signed by a CA that isn't robustly distributed yet? This is a current and up to date Sony Xperia 5 iii - it's not some ancient device...

[#15]

As a further data point my older Android 9 Sony Xperia XZ1 using the usually utterly reliable Sony Mail Client is also failing with a certificate error.

It has the same DigiCert Trusted certificates as my Android 13 device, so up to G4 but no G5