I have a VPS where some of the users have used their Gmail accounts to check the mail (using Gmail's "other POP3 accounts I own"-feature). However, we forgot to renew the SSL certificate in time, but even after adding a new certificate (RapidSSL), Gmail does not accept the new certificate. We can get around it by telling everyone to switch to non-SSL, but it would be better if we could get Gmail to accept the new certificate and keep using SSL.

I checked the certificate using https://www.digicert.com/help/ with my vps'address+ ":995", just to make sure everything was ok, and everything checks out.

It seems to me Gmail believes it's still the old certificate there, that it doesn't recognize the new one, but the error message we get is not really that helpful - "SSL error: unable to verify the first certificate" - so I don't really know what's the problem.

I have also tried to delete the extra POP3-account from the Gmail settings, but no luck.

  • 1
    Did you ever find a solution to this? Was it just a matter of waiting for gmail to clear a cache or something? – alexw Jun 22 '16 at 4:19

You just need to wait it out.

I've had this exact same issue (twice now!). Each time, I fiddled around with my postfix and dovecot settings for a few hours in vain. In the end, it was just a matter of giving it a few hours for Google to see the new cert.

They (Google) surely seem to be above their head. Not accepting self-signed certificate is one thing but rejecting/objecting to certificate issued by

CN = DST Root CA X3
O = Digital Signature Trust Co.

and cross signed as well (read --> https://letsencrypt.org/certificates/) seems a tad bit harsh. I have had success in using my mail server as SMTP to send email from Gmail. Have a look at https://support.google.com/mail/answer/21291?ctx=gmail&hl=en&authuser=0 to see if that answers your concern.

I know this isn't an answer but rather clarification which could help many others like me who faced this issue.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.