# Adding TLS certificate along with SMTP configuration
**URL:** https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360
**Category:** Self-hosting
**Tags:** email
**Created:** [May 4, 2020, 7:28pm UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360 "2020-05-04T19:28:52Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@squarepants](https://meta.discourse.org/u/squarepants)
#### Post date: [May 4, 2020, 7:28pm UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/1 "2020-05-04T19:28:52Z")
I am trying to use my own send-only server to send emails. I am running this SMTP gateway to use TLS because of which the client I use to send emails requires a certificate. I am using a self-signed certificate which is very easily configurable if I use postfix/ssmtp for sending emails but I am not sure how I can use a custom Cert in discourse email client.
Just to get a brief picture in the head:
Easy scenario:
Discourse —send—mail—\> mailgun —send–mail—\> user
My Scenario:
Discourse —send–mail–\> my server running SMTP gateway —relay-mail-using-aws-ses-API—\> user
Thank you.
---
### Author:  [@squarepants](https://meta.discourse.org/u/squarepants)
#### Post date: [May 10, 2020, 11:02am UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/2 "2020-05-10T11:02:00Z")
I would like to correct my question. So I really don’t need to add any certs for this to work but still its failing to communicate on TLS. If I am testing it with swaks its working fine. Example command:
```plaintext
swaks --to user@example.com --from me@example.com --auth PLAIN --auth-user myusername -tls -s smtp.somehost.com:2525
```
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [May 10, 2020, 11:07am UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/3 "2020-05-10T11:07:08Z")
You can directly use the AWS SES SMTP to achieve this why do you want to have a local relay?
---
### Author:  [@squarepants](https://meta.discourse.org/u/squarepants)
#### Post date: [May 10, 2020, 11:37am UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/4 "2020-05-10T11:37:12Z")
@itsbhanusharma AWS ses provides 60k emails per month free and as far as I know these email calls should be requested from ec2 instance to work otherwise they are charged as normal. My discourse instance is hosted on a digital ocean droplet. I could be wrong but this is my understanding and the reasoning behind it.
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [May 10, 2020, 11:46am UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/5 "2020-05-10T11:46:57Z")
So even if Your SES API is receiving emails from a DigitalOcean IP, it would make it chargeable, You may decide to use another service or spin up exim on an ec2 instance to be a bridge between your DO droplet and AWS SES. I don’t think it’ll work but You can try.
It should (in theory anyway) be like:
1. Discourse (on DO) sends emails to exim IP in EC2
2. EC2 relays emails received from DO to SES
3. SES delivers emails to the end user.
---
### Author:  [@squarepants](https://meta.discourse.org/u/squarepants)
#### Post date: [May 10, 2020, 11:51am UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/6 "2020-05-10T11:51:30Z")
I have already solved the relaying problem by running a local smtp server in ec2 which eventually forwards the smtp request to ses. The problem is discourse is failing on TLS handshake with this smtp server where as postfix/swaks and similar applications are working just fine.
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [May 10, 2020, 11:53am UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/7 "2020-05-10T11:53:14Z")
Solving that should be as simple as using port 25 (without encryption)
---
### Author:  [@squarepants](https://meta.discourse.org/u/squarepants)
#### Post date: [May 10, 2020, 11:53am UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/8 "2020-05-10T11:53:50Z")
Is there a way I can see where this SMTP handshake is handled? Like any library discourse is using in ruby behind the scenes? I don’t want to disable TLS here.
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [May 10, 2020, 12:00pm UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/9 "2020-05-10T12:00:04Z")
Then use a Valid SSL certificate (even letsencrypt should work fine)
---
### Author:  [@squarepants](https://meta.discourse.org/u/squarepants)
#### Post date: [May 10, 2020, 1:35pm UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/10 "2020-05-10T13:35:47Z")
Using valid cert from letsencrypt didn’t help for some reason. Don’t know why.
But after setting this in app.yaml, emails are working now.
```plaintext
DISCOURSE_SMTP_OPENSSL_VERIFY_MODE: none
```
Someone with more knowledge about SMTP might provide why this is working but I am good for now I guess.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [May 10, 2020, 1:36pm UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/11 "2020-05-10T13:36:41Z")
Does this end up being cheaper than simply moving the discourse instance into S3?
---
### Author:  [@squarepants](https://meta.discourse.org/u/squarepants)
#### Post date: [May 10, 2020, 1:41pm UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/12 "2020-05-10T13:41:06Z")
I have a $ 5 ec2 instance running on aws which I am using for relaying multiple domains. Moving discourse to ec2 would be a little costly from digital ocean, not much to be honest(few dollars over all).
But the point is even if I move discourse to ec2, I would still need that relay service to support rest of the droplets that I have on DO for other domains that I own. So why not just fix discourse 🙂
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [May 10, 2020, 1:42pm UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/13 "2020-05-10T13:42:27Z")
Well, by your own admission Discourse isn’t broken, it interfaces with SES perfectly fine.
You’re doing this to circumvent an SES restriction to relay emails for free.
---
### Author:  [@squarepants](https://meta.discourse.org/u/squarepants)
#### Post date: [May 10, 2020, 1:45pm UTC](https://meta.discourse.org/t/adding-tls-certificate-along-with-smtp-configuration/150360/14 "2020-05-10T13:45:55Z")
That is true, but discourse has nothing to do with SES here. Discourse is communicating with a SMTP server, which could be anything(right now its a relay service). I was wondering how does postfix/swaks and all are working just fine with this SMTP server(from same DO vpc) and not discourse. After setting that var, it is working though. Still I would like to know what library we are using in discourse for SMTP handshake so that I can personally verify if there is anything we can do to improve in discourse.