Hi Felix, thanks for the reply.
Could you elaborate on this please? If the mail server is on the same domain and physical server as the client (the Discourse install) how could a network attacker exploit this and present another self-signed cert themselves?
Also I know this is not ideal, so can you think of any way where Discourse can behave like Apple Mail (and most other email clients), where they ask you to trust (and always remember) the certificate when they first come across it? I think that’s what @riking was trying to do in post 13 and me in post 15.