Gmail does not accept certificate for my other POP3-mailserver

Question

I have a VPS where some of the users have used their Gmail accounts to check the mail (using Gmail's "other POP3 accounts I own"-feature). However, we forgot to renew the SSL certificate in time, but even after adding a new certificate (RapidSSL), Gmail does not accept the new certificate. We can get around it by telling everyone to switch to non-SSL, but it would be better if we could get Gmail to accept the new certificate and keep using SSL.

I checked the certificate using https://www.digicert.com/help/ with my vps'address+ ":995", just to make sure everything was ok, and everything checks out.

It seems to me Gmail believes it's still the old certificate there, that it doesn't recognize the new one, but the error message we get is not really that helpful - "SSL error: unable to verify the first certificate" - so I don't really know what's the problem.

I have also tried to delete the extra POP3-account from the Gmail settings, but no luck.

Answer 1

You just need to wait it out.

I've had this exact same issue (twice now!). Each time, I fiddled around with my postfix and dovecot settings for a few hours in vain. In the end, it was just a matter of giving it a few hours for Google to see the new cert.

Answer 2

They (Google) surely seem to be above their head. Not accepting self-signed certificate is one thing but rejecting/objecting to certificate issued by

CN = DST Root CA X3
O = Digital Signature Trust Co.

and cross signed as well (read --> https://letsencrypt.org/certificates/) seems a tad bit harsh. I have had success in using my mail server as SMTP to send email from Gmail. Have a look at https://support.google.com/mail/answer/21291?ctx=gmail&hl=en&authuser=0 to see if that answers your concern.

I know this isn't an answer but rather clarification which could help many others like me who faced this issue.

Answer 3

The same problem is still present, here is the solution if you cannot see the renewed certificate:

Check certificate:

openssl s_client -starttls smtp -showcerts -connect mail.yourdomain.com:587 -servername mail.yourdomain.com

and it should display the certificate status, example:

......
Start Time: 1622929789
Timeout : 7200 (sec)
Verify return code: 10 (certificate has expired)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK

And if you receive a message about an expired certificate..

Run these commands:

postmap -F hash:/etc/postfix/vmail_ssl.map
systemctl restart dovecot.service
systemctl restart postfix

Check again:

openssl s_client -starttls smtp -showcerts -connect mail.yourdomain.com:587 -servername mail.yourdomain.com

Results:

.....
Start Time: 1622949041
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK

Bingo, now it's ok.