Mail can't verify the identity of the server 'imap.plus.net"

[#1]

@Myhom 

my iPad uses incoming port 110, and I have no idea why that works.

It works because the connection using port 110 is not using encryption and therefore does not require the SSL certificate 

[#2]

---

@Myhom wrote:

I resolved the issue by changing the Imap port setting from 993 for incoming mail to 143 and SSL off, this is in the advanced section in setting on your iPhone, my iPad uses incoming port 110, and I have no idea why that works.

---

You've removed the security from your IMAP configuration by changing it to port 143.  This is the unprotected cleartext IMAP port where your emails fly through the ether between your phone and PlusNet unencrypted, along with your credentials 😮.  This is the same as you iPad which is receiving emails using the POP protocol on port 110.

It would be wise to revert to 993 for the IMAP (on your iPhone) and 995 for POP (your iPad).  That will, of course, cause your emails to fail, so you are left with the option to install the G5 root certificate, or wait/hope that PlusNet fixes it.

But please, don't leave them on unencrypted IMAP and POP!!

[#3]

I’m talking about the trust cert and it’s no coincidence that this is happening now and a simple email to everyone using the service that they may experience some service issues could have stopped people wondering why this was happening, I for example thought a iOS update had caused the issue.

I’m sorry but there is no excuse for not giving people the heads up.

[#4]

Why would I revert to a port that doesn’t work and constantly cancelling the error message every 30 seconds, I need my mail and plusnet needs to fix it.

[#5]

My iPad is using iMap not pop.

[#6]

---

@Myhom wrote:

Why would I revert to a port that doesn’t work and constantly cancelling the error message every 30 seconds, I need my mail and plusnet needs to fix it.

---

Because you don't want the world to know your password?

If you value your privacy/security and you want your email working (we all do) then I suggest you investigate adding the G5 root CA certificate to your device, so that you can then have both security and emails.

It's your choice in the end.

[#7]

---

@Myhom wrote:

My iPad is using iMap not pop.

---

telnet imap.plus.net 110
Trying 217.46.26.23...
Connected to imap.plus.net.
Escape character is '^]'.
+OK POP3 perditon ready on mail.plus.net 00029e1e

That says POP3, not IMAP.

[#8]

And that says iMap not pop

[#9]

---

@Myhom wrote:

And that says iMap not pop

---

Whether you connect to pop3.plus.net, imap.plus.net, or mail.plus.net on port 110, you will get the same response.  Namely:

+OK POP3 perditon ready on mail.plus.net 00029e24

That's the POP mail service telling you its ready to communicate.

If you telnet to the same server (any of those names), on port 143, you'll see:

* OK [CAPABILITY IMAP4 IMAP4REV1] perdition ready on mail.plus.net 00029f90

That's the IMAP server telling you it's ready to communicate.

The server name is mail.plus.net.  imap.plus.net and pop3.plus.net are DNS aliases to the same server.

[#10]

Like many of the corresponders I use older Mac devices and Mac Mail, and since 11/8 was not able to receive emails to my PN address. The non-delivery message was "Mail can't verify the identity of the server imap.plus.net".

After some searching and suggestions from the PN community I found a solution that works (at the moment) on iOS, iPadOS and OSX: I installed the Root Certificate 'DigiCert TLS RSA4096 Root G5'.

I downloaded the certificate from https://knowledge.digicert.com/general-information/digicert-trusted-root-authority-certificates. When on that page locate the above certificate in the table (make sure that it is 'RSA4096 Root G5', there are several similar). Click 'Download DER/CRT' (not PEM). This will download the file 'DigiCertTLSRSA4096RootG5.crt'.

The installation steps are different for iOS and iPadOS, and for OSX, so I will describe them separately.

Important
=========

At the last step of installation / activation you will get a security warning. I chose to accept the risk on the understanding that DigiCert certificates together with Apple offer protection, but you must decide whether you want to go ahead.

iOS and iPadOS
==============

At the download you will get the message 'review the profile in Settings app in you want to install it.

Go to Settings where you will see a new link "Profile Downloaded" below the link "Apple ID etc"

Click "install"

Alternatively you can go to Settings > General > VPN & Device Management where you can see the profile under "Downloaded profile". Click on that then click "install".

At that stage the profile is not activated.

Go to Settings > General > About and scroll right down to "Certificate Trust Settings" and enable the 'DigiCert TLS RSA4096 Root G5'.

After a couple of minutes you should be able to get your PN emails.

OSX
===

Double click the downloaded 'DigiCertTLSRSA4096RootG5.crt' file. You will get a pop-up saying "The “System Roots” keychain cannot be modified" and underneath: "To change whether a root certificate is trusted, open it in Keychain Access and modify its Trust Settings."

In Applications > Utilities find and open 'Keychain Access.app'.

In the "System" tab you will see the 'DigiCert TLS RSA4096 Root G5'.

Right-click on it and select "Get Info".

Expand the "Trust" section.

From the "When using this certificate:" dropdown, select "Always Trust".

=====

I hope this will help some frustrated PN users.

[#11]

Ok I gotcha,

We’ve got off topic a little here, I need my emails service working securely preferably so whats the permanent fix and whens it coming? 
why hasn’t plusnet issued a fix?

I NEED MY EMAIL SERVICE WORKING PLUSNET!!!! and if I’m using 143 its because Plusnet has put me in that position.

I really don’t think some people on this forum realise how big a problem not receiving important emails is and are quite blasé about it.

[#12]

@Myhom 

This is very much ON topic.

If you need your "emails working securely" with a permanent fix, then you need the CURRENT root security certificate installing on your personal device.  Either you get your product vendor to do that through their maintenance updates, or you do it yourself following some of the excellent advice offered here by @j123 or @eec .

I have just done this on a rather old iPad and was preparing an illustrated guide before @eec posted.

Your point about a "permanent fix" is indeed quite pointed: until a current root certificate is installed on one's device, users are at the same risk of disruption with ANY service which issues a 'pure' new security certificate.

No one is blasé about the issue - there is no inhibition at all to receiving emails (they are still being delivered to your mailbox), it just might not be convenient to access then on obsolete devices.  Your email remains securely accessible via the webmail.plus.net interface.  Granted, not convenient, that though is a matter brought about in large part by your product vendor.

For a good while I have not been able to access my Office365 email on my iPad - either I buy a new one, or I access it via the web interface, or some other device ... we have alternative choices, not none at all.

[#13]

Thank you for that info, thats great,
Why would this be happening on an up to date iPad though, any ideas?

[#14]

When you say an "up to date iPad", can you expand on what you mean?  Is it a fairly new iPad, or is it an older iPad which has been updated to the latest that Apple will allow it to?

I have 2 iPads which have both been updated as far as they can.  The newer one of the 2 has iPadOS 18.6.  The older one is on iPadOS 15.8.4 and will not be offered to update to 16 or later.

[#15]

Yes it’s a current iPad with latest iOS installed