SMTP TLS certificate expired (STARTTLS)

STARTTLS and SMTPS fail when the mail server's certificate is past notAfter, silently hurting deliverability and client configuration.

Mail clients and MTAs negotiate TLS after EHLO, using the MX or submission host certificate. When that cert expires, sends may downgrade, queue, or bounce depending on policy.

Web admins forget MX hosts because they are not the marketing site. Monitor mail.example.com and provider submission endpoints separately from www.

First response

SMTP STARTTLS fails when the MX or submission host presents an expired certificate. Test port 587/465 TLS by name and renew mail server certificates before deliverability drops.

Search interest in smtp tls certificate expired rises when the leaf notAfter on the hostname customers type is already in the past. Clients cannot rewrite server certificate dates; they only accept chains that pass PKIX checks at handshake time.

For SMTP TLS certificate expired (STARTTLS), prove the failure from outside your office VPN before you change application code, purge caches, or ask end users to reboot. Capture the broken serial number and notAfter, renew on the listener that actually terminates that name, reload every node in the path, then re-run the same OpenSSL and browser checks that opened the incident.

Escalations for email-tls-certificate-expired should cite fresh openssl s_client -starttls smtp -connect mx.example:587 output before anyone edits client code or blames Wi‑Fi. SMTP STARTTLS fails when the MX or submission host presents an expired certificate. Test port 587/465 TLS by name and renew mail server certificates before deliverability drops. When TLS handshake failures on ports 587 and 25 clusters around SMTP STARTTLS on submission and MX, the expired material is usually bound to the mail server's public TLS certificate instead of a mysterious platform bug. Executive summaries need the public hostname and current notAfter, not screenshots from a VPN-split test laptop.

See also Ecommerce checkout down due to SSL expiry and HSTS sites with expired certificates: harder recovery.

What this error means

SMTP TLS uses the same X.509 rules as HTTPS. Expired certificates fail verification in strict clients and may be rejected by downstream providers scanning encryption.

Port 587 submission and port 465 SMTPS each present a certificate for the name clients expect. Mismatch plus expiry compounds failures.

Renew on the MTA or relay appliance, reload the mail service, and verify with openssl s_client -starttls smtp.

In PKIX terms, SMTP STARTTLS on submission and MX treat the TLS Certificate message as authoritative: signatures must verify, each link must be within notBefore/notAfter, and only then does name matching run against CN and SAN. When the leaf expired, TLS handshake failures on ports 587 and 25 is expected even if the issuer is publicly trusted. Guides titled email tls certificate expired still require reading dates on every certificate the server sends, including forgotten cross-sign intermediates.

Triage for email tls certificate expired should reject quick myths: flushing DNS or rebooting laptops does not move server notAfter forward. It is not proof the whole internet is broken when other HTTPS sites load for SMTP STARTTLS on submission and MX. It is not interchangeable with registrar billing lapses unless revalidation fails later. It is not fixed by turning off TLS at the load balancer while marketing keeps publishing https:// links. Validated externally, openssl s_client -starttls smtp -connect mx.example:587 must show fresh dates on the mail server's public TLS certificate before you close the incident.

Common causes

These patterns appear often during smtp tls certificate expired incidents. They are not exhaustive, but they explain why renewal looked finished internally while strangers still received expired material.

Runbooks for email tls certificate expired most often break at handoff: certbot or a vendor portal issued new certs, but the mail server's public TLS certificate never received a reload. Teams tracked PEM files in git while production continued serving the previous listener binding. OV renewals waited on legal approvers until TLS handshake failures on ports 587 and 25 became customer-visible. Inventory spreadsheets omitted the hostname that SMTP STARTTLS on submission and MX actually call during peak traffic.

Architecture amplifies email tls certificate expired: multiple regions, canary pools, or blue/green deploys can leave one ASG member presenting yesterday's fullchain. Shared IP default certificates silently terminate vanity hostnames without dedicated SNI rules. Mounted TLS secrets updated on disk while Envoy or nginx workers kept the old chain until signaled. SMTP STARTTLS fails when the MX or submission host presents an expired certificate becomes harder to debug when only a fraction of SMTP STARTTLS on submission and MX hit the stale anycast node.

Measurement gaps complete the story for email tls certificate expired. Synthetic monitors that disable certificate verification greenlit deploys that fail for real SMTP STARTTLS on submission and MX. Redirect maps hid which hop expired until operators ran openssl s_client -starttls smtp -connect mx.example:587 per hostname. Dashboards celebrated TCP uptime while notAfter crossed midnight UTC without a page. Post-mortems should ask whether CT logs or stapled OCSP would have warned days earlier.

Confirm from the outside

OpenSSL

echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Use -starttls smtp on port 587 with -servername set to the MX hostname.

How to read the output

Start with openssl s_client -starttls smtp -connect mx.example:587 against the live customer hostname, capturing the leaf presented after SNI selection. Interpret notBefore= and notAfter= first: past notAfter guarantees failure for TLS handshake failures on ports 587 and 25 regardless of pretty issuer branding. Next read subject= and any X509v3 Subject Alternative Name extension for alignment with the URL bar. Finally note issuer= so you know whether renewal changed intermediates; record serial numbers in the ticket for post-deploy diffing.

curl

curl -vI --connect-timeout 10 https://HOST/ 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

curl is not ideal for SMTP; stick to openssl or swaks for STARTTLS tests.

Browser spot-check

Browsers rarely show SMTP certs; use Thunderbird certificate viewer only after TLS works via openssl.

Fix checklist

Work this list in order for smtp tls certificate expired (starttls). Each step should produce evidence (command output, timestamps, serial numbers) you can paste into the incident ticket.

1. List MX, submission, and IMAP TLS hostnames.
2. Test STARTTLS with openssl from external networks.
3. Renew cert covering SMTP service names in SAN.
4. Install chain on MTA or relay appliance.
5. Restart postfix/exim/Exchange frontend as needed.
6. Send test mail through major providers (Gmail, Microsoft).
7. Review TLS-RPT/MTA-STS failure reports if published.
8. Schedule shorter alerts on mail-specific monitors.

Roll out and verify

Procurement for email tls certificate expired begins with a reissue that lists every hostname SMTP STARTTLS on submission and MX need, including forgotten admin and callback URLs. Validate CSR/key pairs, download CA bundles, and schedule work on the mail server's public TLS certificate during a staffed change window. If automation handles ACME, prove challenges use the same DNS names customers resolve publicly, not internal-only labels.

Installation for email tls certificate expired means concatenating leaf and required intermediates the way your stack documents, then touching every node that terminates the name. Reload web servers, recycle ingress pods, or update cloud listener objects so data planes read new bytes. For load balancers, sync default and per-host certificates so SNI cannot fall back to expired defaults. Repeat openssl s_client -starttls smtp -connect mx.example:587 until fingerprints or serials change everywhere responders tested earlier.

Verification for email tls certificate expired must mimic strangers: external synthetics, mobile carriers, and CI jobs without corporate trust roots. Confirm TLS handshake failures on ports 587 and 25 disappeared for SMTP STARTTLS on submission and MX on flows heavier than GET /. Restore any strict TLS, HSTS, or CDN SSL modes relaxed during firefighting. Feed the hostname into continuous notAfter monitoring with thresholds well before the next CA-enforced renewal cliff.

What to automate

Certificate files on disk lie. Automate live TLS checks on the exact hostname and port users hit, including redirects and the certificate presented after TLS terminates on a load balancer or CDN. Pair certificate notAfter with RDAP domain registration expiry so re-validation is not blocked by a lapsed registrar.

Probe port 587 STARTTLS in addition to HTTPS homepages. Schedule alerts at 30, 14, 7, and 1 day before expiry so on-call has runway for ACME failures, manual OV revalidation, or change windows. Services such as ssldays can run external checks and renewal reminders without replacing your CA workflow.