Mail can't verify the identity of the server 'imap.plus.net"

[#1]

@chalkridge It is not up to Plusnet to ensure Apple keep their root certificates current.

[#2]

Hi everyone,

Please see this update from our support team:

As part of the regular renewal of the SSL certificate for mail.plus.net / imap.plus.net and similar for Force9 and FreeOnline, our certificate provider have switched to a new certificate authority certificate for signing, due to internal changes on their side.

Whilst most modern devices should either already have this new signing cert in their trust stores, as it was issued in 2021, it's possible that devices last updated before this may not have this available.

If you’re using an older device and are experiencing this issue, you may be able to manually obtain the certificate file for "DigiCert TLS RSA4096 Root G5" and import it as mentioned earlier in this conversation. (Thanks to @j123 for sharing)

James

[#3]

Having same issue on iPhone showing imap sever identity error if incoming SSL is put to enable but works ok if no SSL.

Have No problem with outgoing SSL set to enable.

Anyone help please.

[#4]

Sorry, that's a pretty poor response @James_B

Yes it was issued in 2021 but it clearly hasn't been distributed to many still active mobile devices and on most mobile devices, for good reason, it's not straightforward to manually update root certificates.

One of my Android 13 devices is actually under 2 weeks old, my 2 Fire OS 8 devices are around 8 months old.

In my day job part of my responsibility covers judging which certificate provider to use for our services, it can be hard to balance using a more recent root certificate and the mobile user population is always the thing that lags a little.

Is Plusnet's final view then that having recent (under a year old) devices excluded from their services is acceptable, rather than choosing to use a certificate signed by a more widely available root certificate?

And, no, manually trusting a certificate (if the mail client has that ability) is not a solution either. It would be particularly odd to choose a more recent root certificate to increase security and then advise a significant number of mobile users to just accept whatever certificate is presented and bypassing the whole point of a root certificate to access Plusnet services.

[#5]

Fair enough, townman.  Obviously I'm no expert, don't understand what's gone on - and quite frankly, all the IT speak goes completely over my head.  It just seems to me that, based on the number of other people having problems, somebody somewhere has overlooked us (either deliberately or mistakenly), and are therefore to blame.  But, if I'm wrong to make that assertion, then I'm happy to be corrected.  The main reason that I joined the forum was to simply thank j123 for helping me and others to fix the problem.

[#6]

I would have thought DigiCert was a fairly reliable provider, with quite a long track record?

[#7]

As an aside I've found out why my only remaining working Android mobile client (Bluemail) is working - in the TLS configuration it has an explicit option for certificate validation which I'd never noticed defaults to off.

[#8]

@Townman

I strongly disagree with the statement "There is not going to be a fix from Plusnet as the source of the problem is elsewhere"

Plusnet choose which certificate providers to use and there are other acceptable root certificates available. They have chosen to use a certificate signed by a root certificate that is not well distributed in mobile operating systems.

I accept that was likely not a deliberate choice but it is entirely within their agency to use a more widely trusted certificate to solve this issue, and choosing not to do that is entirely Plusnet's choice.

[#9]

---

@James_B wrote:

Whilst most modern devices should either already have this new signing cert in their trust stores, as it was issued in 2021, it's possible that devices last updated before this may not have this available.

---

MacOS 14 (Sonoma) was released in September 2023 and doesn't have it.

Plusnet's cert change has just impacted quite a lot of not-really-that-old Macs (and iPads and iPhones).

I think I am one of the lucky ones (on this occasion), since my Mac can take MacOS 15. I just need to pull my finger out and update it, and it sounds like this will be sorted.

I guess the longer-term solution is to stop using Plusnet email addresses, but that's easier said than done when you've been using hundreds of variations of them for nearly two decades.

[#10]

Not aimed at anyone in particular, but  I understand PN  have been using DigiCert for some considerable time, during which they have not had any issues....

[#11]

@jab1 

The G4 variant is well distributed and has been for a long time, for example it is in iOS 12.1 - the latest certificates use the G5 variant (one guesses improved security) but other platform managers have not distributed that root certificate to all (historic) products.

[#12]

Fair enough, @Townman . Must admit it is something I haven't/don't worry about - my PN mail doesn't touch my Apple devices.

[#13]

I am not that well up on email configuration and most of this discussion is going over my head.

I have this same problem since the early hours of yesterday on both mine and my wife's iphones and we can no longer receive any Plusnet email but sending is OK. I recognise that it is to do with certificate validity but don't understand the implications going forward.

The iphones are both running ios 16.7.11 and using the default Apple Mail client. I have tried to update the phone SW but I'm told this is the latest version for my devices.

I have tried disabling SSL in incoming mail settings as suggested above but this doesn't make any difference, still no mail received and same error message.

Can someone please advise me if there will ever be a solution to this problem or will I have to find an alternative email client for my iphones? Any sugestions?

Is it even possible for me to bypass this problem by somehow installing a valid certificate which I don't know how to do?

A reply in layman's terms would be appreciated.

Thank you

[#14]

Following my previous post ref: my ipad and phone ios versions, i have now updated both devices (reluctantly) and both are now able to download emails. Doesn't help anyone unable to update older devices though- I think my kids maybe complaining to me soon - all with plusnet mailboxes and hand me down phones....

[#15]

@James_B 

Is there a solution for the Plusnet admins here?

<https://knowledge.digicert.com/tutorials/install-the-digicert-g5-cross-signed-root-ca-certificate>