Yes. That's the point of publicly-trusted certificates--you shouldn't ever need to manually trust them. If you do, something is wrong. There are several candidates for that "something", but the one that seems to come up most often in the email context is that (using your examples) the client is connecting to XYZ.com, but the server is presenting a certificate for (only) host.servername.com. It's possible (common, even) to have more than one name on a cert; in the case you describe, you should probably have a single cert that covers both xyz.com and host.servername.com.
The problem is aggravated by the fact that iOS devices don't tend to have as much flexibility as real computers, so a configuration problem that could be worked around on a computer, can't on an iPhone.
The issue tend to be vary… you probably need to share us the exact error message and the certificate output (the subject name, common name, certificate authority) in order for us to help you better…
If the above post resolved your issue, please tell us (so we could close this thread)… if not, please provide us the following information:
Certificate shown in the “do you trust screen”
CA of that certificate
Or please provide us the domain name in issue & port (for smtp / pop) so we could try to connect to the server and see what’s the output of the certificate.
yes, that link your provided, all steps were done (I actually redid step 7)
these are client emails (only people with iPhone), my email is fine and all clients with any BESIDES iPhone.
because on item 1 above, there were already selected, it did not change/fix anything.
so when the iphone user who tries to use email: they see this:
cannot verify server identity
The identity of “xyz.com” cannot be verified by Mail. Review the certificate details to continue.
Continue
Details
Cancel
note: click continue does nothing but SHOW you a lot of stuff… the same option as Details.
NOTE: all other clients I have seen: android, mac os, etc… when this happens, it has a check box that you can select to “Trust it”. You click the box and hit continue. all is good. BUT the iphone does not have the check box.
AND the only solution I know is to delete email account and SMTP server OFF the iPhone and just added it back. Exact Same Settings. And it works just fine.
So the 1st time iPhone tries a cert… it will trust it. IF however, the Lets Encrypt cert updates/renews… it fails.
and I have to go back to delete and add it again.
and all links/clicks basically go no where… you can’t “do” anything.
TO ME… its an iPhone bug. The iPhone should add a “trust checkbox”, just like the MAC OS…
and all is good.
HOWEVER, the above replies are telling me I should NEVER need to “Trust” a cert… but I’ve always had to trust a cert for email while I have used Plesk over the years.
thanks, but the real domain, real details are not in question. The issue is why is the problem coming up to begin with.
PS. my client just deleted email account/ SMTP server off the iphone and added it back. All is working now. same settings, etc. BUT I can’t have client do this every 3 months.
It kind of is. It's pretty hard for us to tell exactly what's going on without being able to see the actual domains. Recall that when you opened the topic, you would have been presented with the following:
Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
If you could decide that the real domain isn't really important, then I guess you should be able to figure out yourself what the problem is, right?
Not trying to be mean here, but if you don't really actually know the problem, how do you actually know the real details aren't possibly the answer to the problem?
I personally think the issue is with the configuration of your services… (since no SNI is enabled)
Since connecting with openssl s_client -connect 501ranch.com:465 -servername 501ranch.com (and all encrypted mail port) only show a certificate for subject=/CN=host.webinteractiveconsulting.com.
I’m even suspecting if Plesk have SNI support on mails… (As of Aug 17 2018, more certificates for mail servers still need to be done from command line…)
Hi @larryk
The output from POP & SMTP & IMAP are with an valid certificate, however without SNI (so it will always be your server certificate instead of the sites certificate)
That’s the reason your clients always need to “true” the certificate… (And a 2 year certificate in your means, only represent that the user won’t need to retrust the certificate again in two years) I’m afraid there’s no automated “working” solution, you’ll need to wait until Plesk decided to support it… (Or there might be some plugins that will help your server setup SNI, just might be)
Juergen,
so that is some left over SSL? I don’t think its on my server, but will check. So you are thinking iPhone sees that old one instead of the Lets Encrypt one? But iphone works as long as cert doesn’t get renewed.
outgoing / sending was the problem as incoming mail would work.
ps
but other clients/iphone user could not send or receive, etc. I agree that settings are important… BUT none the less, after the renewal of cert… problem happened AFTER the renewal
