IMAP diagnostics
certificate verify failed when connecting over IMAP
How it looks in the log
SSL connect attempt failed error:0A000086:SSL routines::certificate verify failedThe TLS connection came up but the client could not trust the server certificate. Encryption still works — what fails is the name, the chain of trust, or the expiry date.
Causes, most likely first
- The shared hosting classic: the certificate is issued for a server name such as srv142.hoster.net while you connect to mail.yourdomain.com.
- A self-signed certificate — typical for internal Exchange and self-run Dovecot servers.
- An expired certificate: Let’s Encrypt failed to renew and the mail service still serves the old one.
- An incomplete chain: the server sends only the leaf certificate without the intermediate.
How to fix it
- Check which name the certificate covers: openssl s_client -connect host:993 -servername host | openssl x509 -noout -subject -dates
- Connect using the name on the certificate — that is the fix, not a workaround.
- If that is impossible, enable accepting unverified certificates in advanced settings. Traffic stays encrypted but server identity is not checked.
- On your own server, fix the cause: renew the certificate or add the missing intermediate.
FAQ
Common questions
Is accepting an unverified certificate safe?
Traffic stays encrypted but you lose protection against server impersonation. On a controlled network or a host you own the risk is small; on a public network, resolve the name mismatch first.
Why does my mail client connect when the migration does not?
Clients like Thunderbird ask once and remember the exception. An automated transfer never sees that dialog and fails instead.
Other errors
Find out how big your mailbox is. It costs nothing.
Connect two servers, look at the size and decide. Or take the client and keep everything on your side.
Code on GitHub · built on imapsync · no sign-up