# באג אפשרי במייל: certificate verify failed (unable to get local issuer certificate)
**URL:** https://meta.discourse.org/t/possible-bug-with-mail-certificate-verify-failed-unable-to-get-local-issuer-certificate/289707
**Category:** Self-hosting
**Created:** [25 בדצמבר, 2023, 6:16am UTC](https://meta.discourse.org/t/possible-bug-with-mail-certificate-verify-failed-unable-to-get-local-issuer-certificate/289707 "2023-12-25T06:16:43Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@AstonJ](https://meta.discourse.org/u/AstonJ)
#### Post date: [25 בדצמבר, 2023, 6:16am UTC](https://meta.discourse.org/t/possible-bug-with-mail-certificate-verify-failed-unable-to-get-local-issuer-certificate/289707/1 "2023-12-25T06:16:43Z")
Set up a discourse install on a new server and had issues with mail (`certificate verify failed (unable to get local issuer certificate)`) even though I could send/receive email from the same address via my Mac and iPhone (without it complaining about certs or anything like that).
Tested using the guide here: [How to Test SMTP AUTH using Telnet []](https://www.ndchost.com/wiki/mail/test-smtp-auth-telnet) again which passed: `235 2.7.0 Authentication successful`.
In the end I added this to app.yml following @Falco’s post in another thread:
```plaintext
DISCOURSE_SMTP_ENABLE_START_TLS: false
DISCOURSE_SMTP_OPENSSL_VERIFY_MODE: none
```
But it still feels like a bug as the same email with the same credentials is working fine elsewhere, so thought I’d post here just in case.
---
### Author:  [@packman](https://meta.discourse.org/u/packman)
#### Post date: [25 בדצמבר, 2023, 7:30am UTC](https://meta.discourse.org/t/possible-bug-with-mail-certificate-verify-failed-unable-to-get-local-issuer-certificate/289707/2 "2023-12-25T07:30:04Z")
The error you’ve seen is related to the mail protocol and isn’t address specific. For some reason your Discourse instance isn’t negotiating a TLS connection with the destination mail server. You’ve fixed it by turning off TLS negotiation during the mail sending connection
When you’re using your phone that’s probably sending the messages through a different server, or if it’s the same destination server then the phone is able to negotiate TLS correctly.
---
### Author:  [@AstonJ](https://meta.discourse.org/u/AstonJ)
#### Post date: [26 בדצמבר, 2023, 6:58pm UTC](https://meta.discourse.org/t/possible-bug-with-mail-certificate-verify-failed-unable-to-get-local-issuer-certificate/289707/3 "2023-12-26T18:58:30Z")
> [@packman](#):
>
> For some reason your Discourse instance isn’t negotiating a TLS connection with the destination mail server.
Any ideas how we can troubleshoot this Chris?
> [@packman](#):
>
> When you’re using your phone that’s probably sending the messages through a different server, or if it’s the same destination server then the phone is able to negotiate TLS correctly.
Both Mac and iPhone have been configured to use the same mail.domain server to send mail, and following [the test](https://www.ndchost.com/wiki/mail/test-smtp-auth-telnet) was successful (though I am not sure how closely that replicates what Discourse is doing).
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [26 בדצמבר, 2023, 8:58pm UTC](https://meta.discourse.org/t/possible-bug-with-mail-certificate-verify-failed-unable-to-get-local-issuer-certificate/289707/4 "2023-12-26T20:58:25Z")
> [@AstonJ](#):
>
> `DISCOURSE_SMTP_OPENSSL_VERIFY_MODE: none`
If your clock is way off then certs can appear expired when they are not. It could be that the SSL libraries used by your mail provider are incomplete.
Clicking the “disable security” button is never recommended.
---
### Author:  [@AstonJ](https://meta.discourse.org/u/AstonJ)
#### Post date: [26 בדצמבר, 2023, 10:30pm UTC](https://meta.discourse.org/t/possible-bug-with-mail-certificate-verify-failed-unable-to-get-local-issuer-certificate/289707/5 "2023-12-26T22:30:35Z")
Time on the server is correct Sam. Which SSL libraries does Discourse need the mail server to have?
The thing that makes this odd is that (Apple) Mail is usually very quick to warn of issues, yet the same emails work fine on my Mac.
The only other thing I can think of is DNS propagation because this is a new sever and the email host was slightly different on the old server (but the email is being hosted on the same server as the forum so not convinced this would be the issue).
---
### Author:  [@AstonJ](https://meta.discourse.org/u/AstonJ)
#### Post date: [27 בדצמבר, 2023, 2:56am UTC](https://meta.discourse.org/t/possible-bug-with-mail-certificate-verify-failed-unable-to-get-local-issuer-certificate/289707/6 "2023-12-27T02:56:07Z")
Thanks Sam! Sorted!
For some reason I had forgotten to configure `chain.pem` in Postfix ☺
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [26 בינואר, 2024, 2:56am UTC](https://meta.discourse.org/t/possible-bug-with-mail-certificate-verify-failed-unable-to-get-local-issuer-certificate/289707/7 "2024-01-26T02:56:30Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.