Is it possible to specify an SSL certificate that MailKit should validate?

[ccase47]

If there are several certificates on the SMTP server, how does MailKit choose and validate one? Or does it run the validation callback for each certificate? Is it possible to specify a certificate on the SMTP server (not a client certificate) that the user wants to validate?

[jstedfast]

I'm not that familiar with the SSL protocol, but my understanding is that the server decides which SSL certificate to use and then sends the client a certificate chain for the client to validate.

The client, as far as I understand, does not get to "pick and choose" which certificate to use/validate.

Are you asking this question because you have a server that hosts multiple domains or something?

[ccase47]

Thanks! The SMTP server we're working with has a certificate that's not being validated even though it's working within other applications, so their thought was to try with a different certificate. It makes sense though that the server decides on the certificate and the client can't pick and choose.

[jstedfast]

If an SSL certificate isn't validating in the client but does validate in other clients, it likely means that you might be missing the Root CA certificate on the client's system and/or it isn't "trusted".

This is all implemented in dotnet's SslStream, so I don't know the details, but I do know that on different host OS's, the certificate store that is used is also different. For example, on Windows, it uses the Windows Certificate Store while on Linux, it will use whatever store OpenSSL uses. On Mac, I'm not sure, I know it uses OpenSSL but it might use the Mac Keychain as the certificate store?

[jstedfast]

What I mean by "Root CA Certificate" is, lets say your server's SSL certificate was created & signed by LetsEncrypt, then you will need to make sure that the LetsEncrypt Root certificate is stored in the appropriate location on your client system so that it can validate the SSL certificate chain.

On Windows, I think you'd launch the "Manage computer certificates" program from the Control Panel and add the certificate to the "Trusted Root Certificate Authorities" but I'm not 100% sure about that.

[ccase47]

This is good to know! I will check and make sure that the Root CA certificate is configured correctly. One of the errors that came back was "A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider", so looks like this may be the problem.