Our mail servers present certificates from Let's Encrypt. The chain ends at the root certificate ISRG Root X1. The certificate covers the server hostname, for example outbound.mailhop.org. It changes about every 60 days.

Which systems can show an error

Only a system that validates our certificate can show an error. Examples:

  • Microsoft Exchange Server with a Send connector to our smart host, with "Require TLS" and a TLS authentication level of CertificateValidation or DomainValidation. The queue shows:
    451 4.4.0 Primary target IP address responded with: "454 4.7.5 Certificate validation failure"
    Exchange creates this text itself. Our server does not send it.
  • Postfix with smtp_tls_security_level = secure or verify: "certificate verify failed" or "unable to get local issuer certificate".
  • Java applications: "PKIX path building failed".
  • .NET applications: "The remote certificate is invalid according to the validation procedure".

Causes and fixes

  1. The system does not trust ISRG Root X1. Update the trusted root certificates of the operating system. If the system uses its own list of certificate authorities, add ISRG Root X1 from https://letsencrypt.org/certificates/. On Exchange, install the root in the Trusted Root Certification Authorities store of the computer account. Then restart the Microsoft Exchange Transport service.
  2. (Exchange, DomainValidation) The TlsDomain value does not match the certificate. Set TlsDomain to outbound.mailhop.org.
  3. (Exchange, CertificateValidation) The server cannot fetch the certificate revocation list. Allow outbound HTTP (port 80) from the Exchange server to *.c.lencr.org.
  4. The system pins our certificate or its fingerprint. Remove the pin. The certificate changes about every 60 days. If the system must restrict the issuer, trust ISRG Root X1.

Check from your server

openssl s_client -starttls smtp -connect outbound.mailhop.org:587 -servername outbound.mailhop.org </dev/null

The output must contain "Verify return code: 0 (ok)". If it shows "unable to get local issuer certificate", the server does not trust ISRG Root X1.

If the error continues after these steps, send us the full error text, the date it started, and the output of the command above.