Mail can't verify the identity of the server 'imap.plus.net"

[#1]

I do not think this has anything to do with "stale" root certificates in older OS systems.

One case in point is my iOS 15 iPhone does not show any error with certificates connecting to the free-online email. Also others posting problems that have more up to date OS systems compared to mine.

I also note that from a screen shot earlier there was a discrepancy between imap.plus.net and the certificate which showed mail.plus.net , this need more investigating as a possible error (either by the person who posted it or by a PlusNet mistake).

I'll be looking into these certificates (free-online + plusnet) overnight, to see if there is anything unusual between the two or any other errors.

[#2]

OK, after some checking it appears that force9 and free-online are still using the older certificate, expiring Aug 18th (this year) and is using the more widely supported GeoTrust G2.

Plusnet one is using the GeoTrust G5 (which appears to be much less widely supported - going by the numbers posting here) and expires Aug 9th 2026.

P.S. Discrepancy with imap & mail.plus.net appears to be fine as "imap" is a listed alternate under the main "mail" domain.

Checked using:

curl -w '%{certs}' imaps://imap.plus.net

[#3]

Thanks to @j123 - I’ve downloaded the crt file in the link, downloaded it to keychain and set it to ‘always trust’ but still no luck.  Mac mini 10.15.7. Any help appreciated.

[#4]

@RPMozley 

That cURL command looks interesting; though for windows environments, it needs the .exe extension...

curl.exe -w '%{certs}' imaps://imap.plus.net

At the top of the output I got...

curl: (21) Quote command returned error

Would you know if that has any significance?

How does one interpretate the output?

The SUs are continuing discussions on the matter with the business.

[#5]

@RPMozley 

Thank you - an incredibly useful contribution to the detail of the discussions.

[#6]

Thank Thank you very much j123, truly a "rising star".     Should I be worried about the above?

For the record;

Macbook email was not working.  It was a couple of updates behind but once I updated to MacOS Sequoia 15.6 it worked.

iPhone 12 mini - no problems.

iPad (5th Generation)  email not working, used j123 fix.

Husband's iPhone (I think an 11), slightly hysterical message this morning as email not working. 

[#7]

This is happening because older devices are missing the DigiCert TLS RSA4096 Root G5 certificate from their trust anchor store.

You can verify this by searching (on Android anyway) for certificate or trust in the settings.  After some rummaging around (all phone settings are different - just to annoy us!) you should find a long list of trusted certificates.  The above is listed on later Android phones, but not on devices which are failing to connect.

On some devices you should be able to add the above.  However, doing this is a security risk as if you install an incorrect certificate you may leave your device open to compromise.  But if you're up for it...

Search for DigiCert TLS RSA4096 Root G5 and make sure you click on the https://knowledge.digicert.com/general-information/digicert-trusted-root-authority-certificates link.  Double-check that the address bar contains the above URL.

Find the certificate with a serial number of 08:F9:B4:78:A8:FA:7E:DA:6A:33:37:89:DE:7C:CF:8A and save it to your device. Again, by rummaging around your Android settings you may find an option to install a CA Certificate.  If so, follow the prompts to install the file above.  I believe Android stopped this option at a certain version, so you may be out of luck.

If it all works, emails should start to sync.

Sorry, but I have no idea on how to do this on Apple devices.

Alternatively, you can (or may have to) wait for PlusNet to get their act together.

[#8]

Thank you everyone for your help and input: My iPad and iPhone are now receiving emails again after installing the new certificate as suggested by j123.

It's thanks to you guys willing to share your knowledge and experience that computer duffers like me are able to do anything technical at all!

Dave 

[#9]

@Weystoner1 

Please share how you achieved this on your iphone.

Thanks

[#10]

---

@gareththered wrote:

Alternatively, you can (or may have to) wait for PlusNet to get their act together.

---

Can you please explain this statement?  Since when was Plusnet responsible for ensuring that the platforms we all use keep up with current industry security standards?  This is akin to when TLS 1.0 was deprecated.  Those vendor platforms which did not facilitate the more secure versions became obsolete ... or could not use the up to date security encrypted services.

What is your expectation here - that Plusnet does NOT USE THE CURRENT SECURITY STANDARDS ... if such were even an option.  Apple and Google (or whoever) need to get their fingers out and get their security arrangements brought up to date.

I seem to recall that was the mantra when Microsoft and Gmail imposed tighter security measures ... or is this another never mind the facts, let's just bash Plusnet?

[#11]

---

@Townman wrote:

---

I seem to recall that was the mantra when Microsoft and Gmail imposed tighter security measures ... or is this another never mind the facts, let's just bash Plusnet?

---

Highly likely,  @Townman  - from people who either do not know, or intentionally ignore, the actual responsibilities involved.

[#12]

My wife Samsung is throwing up the cert. error. I deleted the account that was coming with the error. I tried re-entering the account details again to be met by the same failure. Being a very grey haired old man I am finding it difficult to get to grips with the advice offered here. I would like an easy solution if possible.

Last email received was 11th Aug, my phone and PC do not have this problem. Also no other email accounts are effected.

[#13]

Ask Samsung what are their plans to upgrade the security root certificates (DigiCert TLS RSA4096 Root G5) on their devices to the current industry standards.

[#14]

It's only Plusnet failing so it easy to question that it's Plusnet after all it is only their email account thats failing. Many (Who do not use the support) users will be asking what they upto and considering the confusing support by Plusnet (superusers) does not help the belittled less knowledgeable users. 

[#15]

It's only Plusnet failing so it easy to question that it's Plusnet after all it is only their email account thats failing

This is a Plusnet forum so you're likely to only see reports of Plusnet services being affected. However it will potentially affect any service with a recently issued security certificate that references the Digicert G5 root certificate.

considering the confusing support by Plusnet (superusers)

Sorry, but where is the confusing support ?, its been explained that the problem is with the devices that have not been updated to include the G5 certificate. Keeping devices updated is the responsibility of the device vendor. It would seem that some devices can be updated manually with the certificate but this is not a trivial process and is not available on all devices