Unexpected “ The remote certificate is invalid acc

Question

I am trying to connect to an SMTP server from a .NetCore/Ubuntu machine via Mailkit.

I am attempting to connect to port 25 on the server with SSL turned off.

The mail server is a windows server on the local lan, and works fine from other machines with the same settings as are being used on the problem Ubuntu machine.

The code being used to connect is as follows:

            using (var client = new SmtpClient())
            {
                client.Connect("smtp.mydomain.com", 25,false);
                client.Authenticate(username, password);
                client.Send(emailMessage);
                client.Disconnect(true);
            }

However, this throws an exception immediately after the .Connect line with the error message "The remote certificate is invalid according to the validation procedure."

I am surprised that certificates are involved at all on vanilla port 25.

Has anyone got any ideas what is going on?

Answer 1

The server is probably enabling TLS as part of SMTP. This is pretty common, it's the STARTTLS verb.

If this works on other Windows boxes, are you in an AD? If so there's probably a CA on the AD issuing certificates which are automatically trusted via Group Policy. So you need to configure OpenSSL on your Ubuntu machine to trust that CA too.

Or you could just say fuck it, and tell StmpClient to ignore security with

client.EnableSsl = true;

Answer 2

The reason why you see an SSL certificate on port 25 is due to the reason that the server offer a starttls on that port. To find out which SSL certificate is used you can use the following way as mentioned here via OpenSSL:

openssl s_client -connect exchange01.int.contoso.com:25 -starttls smtp

It might be that this SSL certificate used here is selfsigned, then you can either replace that with a trusted one (if you can) or you can trust the selfsigned certificate.