Install Mail Server Certificate Inside Web Container

Beginning in v7.1.0, MI verifies the mail server's SSL/TLS certificate before sending emails. This requires additional configuration if:

  • You use a self-signed certificate (where the internal Certificate Authority (CA) is not trusted by the MI server).
  • You use a mail relay where the relay name does not match the mail server's name in the SSL certificate.

This article describes certificate configuration to ensure the web container can trust the mail server certificate and successfully send emails.

  • See Setup Email for details on configuring System Variables for sending emails.

Table of contents:

  1. Download Root and Intermediate Certificates from Mail Server
  2. Combine Intermediate and Root Certificates
  3. Place Combined Certificate in the Web Container
  4. Change File Extension of Combined Certificate
  5. Restart Web Container

Troubleshooting Mail Server Certificates

1. Download Root and Intermediate Certificates from Mail Server

  1. Access your mail server, click [View site information] near the address bar
  2. [Show connection details]
  3. [Show certificate]
  4. [Details]
  5. [Export] both Root and Intermediate certificates

2. Combine Intermediate and Root Certificates

Access the command line, then concatenate the previously exported certificates into one file.

  • NOTE: Place the intermediate certificate first, followed by the root certificate.
cat Intermediate_CA.pem Root_CA.pem > Root_CA_Inter_TLS.pem

This creates a combined certificate file named Root_CA_Inter_TLS.pem.

3. Place Combined Certificate in the Web Container

  1. Access the certificate directory inside the web container:
cd /opt/mi/ssl/ca-certificates/web
  1. Remove any unused or miscellaneous certificates, keeping only the combined certificate file you just created.

4. Change File Extension of Combined Certificate

Change the combined certificate file's extension to .crt:

mv Root_CA_Inter_TLS.pem Root_CA_Inter_TLS.crt

5. Restart Web Container

After making these changes, restart the web container to apply the updated certificates:

restart web

Once restarted, test email sending again.

Troubleshooting Mail Server Certificates

Run the following command inside the web container to inspect the certificate chain:

openssl s_client -starttls smtp -crlf -connect <mail_host>:25

This command will display the certificate chain and reveal any missing intermediate certificates.