# RocketChat SMTP Server configure failed under private CA certificate signed smtp ssl certificate

**URL:** <https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281>\
**Category:** Community Support\
**Created:** [September 28, 2021, 4:14am UTC](https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281 "2021-09-28T04:14:25Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![ceweithr](https://avatars.discourse-cdn.com/v4/letter/c/cdc98d/32.png) [@ceweithr](https://forums.rocket.chat/u/ceweithr)\
**Post date:** [September 28, 2021, 4:14am UTC](https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281/1 "2021-09-28T04:14:26Z")

</div>

### Description

Rocket Chat Server can not set LAN SMTP Server, and the site has correct certificate signed by our own CA certificate that only exist in LAN. I’ve even install ca-certificates in docker bundle system using `docker exec -it -u 0 bash` and then install our CA.crt into `/usr/share/ca-certificates`, but it does not works with these error output when I click “test sending email”:

**smtps**

- port: 465

```auto
Updating process.env.MAIL_URL
Exception in defer callback: Error: self signed certificate in certificate chain
at ...

code: 'ESOCKET'
command: 'CONN'

```

**smtp**  
-port: 25

```auto
Updating process.env.MAIL_URL
Exception in defer callback: [Error: ... ../deps/openssl/openssl/ssl/record/ssl3_record.c:332:]
{
library: 'SSL routines',
function: 'ssl3_get_record',
reason: 'wrong version number',
code:' ESOCKET',
command: 'CONN'
}

```

### Server Setup Information

- Version of Rocket.Chat Server: 3.18.1
- Operating System: debian 10
- Deployment Method: docker
- Number of Running Instances: 1
- DB Replicaset Oplog: true
- NodeJS Version:
- MongoDB Version: 4.0
- Proxy: none yet
- Firewalls involved: false

Just wondering why I have install our own `CA.crt` to `/usr/share/ca-certificates` with command `dpkg-reconfigure ca-certificates` but the rocketchat still emit error that **self signed certificate in certificate chain** , what does it means? which self signed certificate it is pointing to?

I’ve use command `openssl s_client -connect my.smtp.server.addr.com:465` to verify and checked that the ssl information is correct, which show that it is signed by our own CA certificate instead of a self signed certificate.

### Any additional Information

- currently the website is run in http, I have not make reverse-proxy yet.
- mongo and rocketchat are installed by docker and communicate with `--link` argument on rocketchat docker run command.

---

<div class="post-metadata">

**Author:** ![dudanogueira](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/dudanogueira/32/2529_2.png) [@dudanogueira](https://forums.rocket.chat/u/dudanogueira)\
**Post date:** [September 28, 2021, 4:54pm UTC](https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281/2 "2021-09-28T16:54:02Z")

</div>

Hi!

Can you please check this answer?

> [@Make Rocketchat use certificate for secured SMTP server](https://forums.rocket.chat/t/make-rocketchat-use-certificate-for-secured-smtp-server/12253/2):
>
> Hi! I was checking the source code for your question, and searching for MAIL\_URL I found this: I think the best you can get right now is a mix and match of the following options: rocketchat: ... environment: - MAIL\_URL=smtps://user:password@smtp\_server:25&secure=false&ignoreTLS=true One could work around this requirement by setting up an smtp relay that will use the provided certificate and provide a smtp server that will work with Rocket.Chat.

TL;DR  
I think you can only get a mix and match of the following configurations, at your docker:

```auto
environment: 
  - MAIL_URL=smtp://user:password@smtp_server:smtp_port&secure=false&ignoreTLS=true

```

---

<div class="post-metadata">

**Author:** ![reetp](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/reetp/32/5546_2.png) [@reetp](https://forums.rocket.chat/u/reetp)\
**Post date:** [September 28, 2021, 6:43pm UTC](https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281/3 "2021-09-28T18:43:03Z")

</div>

Is this Issue related to the original OP?

> <https://github.com/RocketChat/Rocket.Chat/issues/23300>
>
> \<!-- 
> 
> Please see our guide for opening issues: https://rocket.chat/docs/contr…ibuting/reporting-issues
> 
> If you have questions or are looking for help/support please see: https://rocket.chat/docs/getting-support
> 
> If you are experiencing a bug please search our issues to be sure it is not already present: https://github.com/RocketChat/Rocket.Chat/issues
> 
> \--\>
> 
> \### Description:
> 
> 
> I deploy rocketchat on a LAN environment which has no internet access, so I can not use the public CA signed certificate. Instead, I deploy other web services with SSL support by using custom CA certificate to sign the website SSL certificate, for example, my SMTP Server. Therefore, I would like to set smtps on rocketchat, but receive error says \*\*self signed certificate in certificate chain\*\*, I guess is the smtps ssl verifying did not pass.
> 
> \### Steps to reproduce:
> 
> 1. Deploy mongo and rocketchat by docker according to official instruction at https://hub.docker.com/r/rocketchat/rocket.chat
> 2. Login to rocketchat with http://localhost:80 and do some admin configuration, then use rocketchat as normal.
> 3. Trying to set email-smtp, filling with this params:
> - protocol: smtps
> - server: smtp.server.addr.com
> - port: 465
> - ignoreTLS: false
> - pool: false
> - username: \<valid email account\>
> - password: \<valid email password\>
> - from mail: same as username
> 
> Then click \*\*save changes\*\* and \*\*send test email to myself\*\*, no email is delivered and logs says:
> \`\`\`
> Updating process.env.MAIL\_URL
> Exception in defer callback: Error: self signed certificate in certificate chain
> at ...
>     
> code: 'ESOCKET'
> command: 'CONN'
> \`\`\`
> 4. use docker command \`docker exec -it -u 0 \<instance name\> bash\` and \`apt-get install ca-certificates\` to install necessary software for adding custom CA certificate to system area under \`/usr/share/ca-certificates\`
> 5. \`docker cp myCA.crt \<instance name\> /tmp/\`
> 6. \`docker exec -it -u 0 \<instance name\> bash\` and \`dpkg-reconfigure ca-certificates\`
> 7. reboot docker instance and try sending email again, failed with same logs pasted above.
> 
> In stackoverflow, somebody say I can add some ignore flag to \`main.js\`, but I neither try the method nor be willing to disable TLS identify, cause it will put my data in and insecure situation. I just want the rocketchat docker can recognize the site SSL certificate signed by my custom CA certificate, which I have put it under \`/usr/share/ca-certificates\`.
> 
> 
> \### Expected behavior:
> 
> 
> SMTP configuration of my private smtp server over personal CA signed SSL certificate works. Because I would like to use my own CA to ensure data transferring security.
> 
> \### Actual behavior:
> 
> 
> SMTP configuration fails and say something about \*\*self signed certificate in certificate chain\*\*.
> \### Server Setup Information:
> 
> \- Version of Rocket.Chat Server: 3.18.1
> \- Operating System: debian 10
> \- Deployment Method: docker
> \- Number of Running Instances: 1
> \- DB Replicaset Oplog: true
> \- NodeJS Version: 12.22.1
> \- MongoDB Version: 4.0
> 
> \### Client Setup Information
> 
> \- Desktop App or Browser Version: 3.4.0
> \- Operating System: ubuntu 18.04
> 
> \### Additional context
> 
> 
> 
> \### Relevant logs:
> 
> 
> 
> 
> \`\`\`
> Updating process.env.MAIL\_URL
> Exception in defer callback: Error: self signed certificate in certificate chain
> at TLSSocket.onConnectSecure (\_tls\_wrap.js:1502:34)
> at TLSSocket.emit (event.js:314:20)
> at TLSSocket.EventEmitter.emit (domain.js:483:12)
> at TLSSocket.\_finishInit (\_tls\_wrap.js:937:8)
> at TLSWrap.ssl.onhandshakedone (\_tls\_wrap.js:711:12)
> at TLSWrap.callbackTrampoline (\_internal/async\_hooks.js:126.14) {
> code: 'ESOCKET',
> command: 'CONN'
> }
> \`\`\`

I’m not sure the solutions here necessarily give the security the poster on the Issue, or the OP here, what they really want.

A point to note with everything about mail is you only have to go though one NON ‘S’ secure server and your whole chain of security collapses.

And once it leaves your server you cannot control how it is routed… could go through multiple non ‘S’ servers.

The only real way to give a reasonable guarantee of security/privacy with email is E2E eg PGP or say Signal or Rocket)

Everything else is really just chasing ghosts.

---

<div class="post-metadata">

**Author:** ![ceweithr](https://avatars.discourse-cdn.com/v4/letter/c/cdc98d/32.png) [@ceweithr](https://forums.rocket.chat/u/ceweithr)\
**Post date:** [September 29, 2021, 1:18am UTC](https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281/4 "2021-09-29T01:18:56Z")

</div>

Yes, I submitted the issue as soon as I make a topic in rocketchat forum.

My SMTP Server has only open port 465, and port 25 is closed. So I have to use smtp server enhanced by SSL from port 465. Do you have any idea that what is the problem?

---

<div class="post-metadata">

**Author:** ![ceweithr](https://avatars.discourse-cdn.com/v4/letter/c/cdc98d/32.png) [@ceweithr](https://forums.rocket.chat/u/ceweithr)\
**Post date:** [September 29, 2021, 1:20am UTC](https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281/5 "2021-09-29T01:20:50Z")

</div>

But SSL can make sure data on the TCP is encrypted. At least the username and password is not exposed.

---

<div class="post-metadata">

**Author:** ![reetp](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/reetp/32/5546_2.png) [@reetp](https://forums.rocket.chat/u/reetp)\
**Post date:** [September 29, 2021, 2:39pm UTC](https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281/6 "2021-09-29T14:39:09Z")

</div>

> [@ceweithr](#):
>
> Yes, I submitted the issue as soon as I make a topic in rocketchat forum.

Please don’t do that. It makes life confusing. Github is only for bugs, not support issues.

See this on how to ask for help properly. Only open an issue when we are pretty sure it is a bug in the code.

> <https://gist.github.com/reetp/a66149d5f060f260643a353ca7067a98>

---

<div class="post-metadata">

**Author:** ![reetp](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/reetp/32/5546_2.png) [@reetp](https://forums.rocket.chat/u/reetp)\
**Post date:** [September 29, 2021, 2:44pm UTC](https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281/7 "2021-09-29T14:44:42Z")

</div>

> [@ceweithr](#):
>
> Do you have any idea that what is the problem?

Yes, not describing the issue properly.

Your bug is not the same as this post.

So you missed out bits like this:

> I deploy rocketchat on a LAN environment which has no internet access

So does Rocket have internet access or not? Where is the SMTP server? On the LAN or elsewhere? Does it have internet access too? What sort of certificates does the SMTP server use?

Please give some more detail of where all these servers are and how they are connected.

---

<div class="post-metadata">

**Author:** ![reetp](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/reetp/32/5546_2.png) [@reetp](https://forums.rocket.chat/u/reetp)\
**Post date:** [September 29, 2021, 2:50pm UTC](https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281/8 "2021-09-29T14:50:12Z")

</div>

> [@ceweithr](#):
>
> But SSL can make sure data on the TCP is encrypted. At least the username and password is not exposed.

True. But that is about it. If that is on your own LAN only then it probably isn’t your highest priority.

---

<div class="post-metadata">

**Author:** ![reetp](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/reetp/32/5546_2.png) [@reetp](https://forums.rocket.chat/u/reetp)\
**Post date:** [September 29, 2021, 2:54pm UTC](https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281/9 "2021-09-29T14:54:57Z")

</div>

Last, this is really a Meteor/Node Issue.

There are lots of pages on Meteor and self signed certificates and the general answer seem sot be to set it something like `tlsAllowInvalidCertificates`

> **[Error: self signed certificate in certificate chain for Meteor 1.11](https://forums.meteor.com/t/error-self-signed-certificate-in-certificate-chain-for-meteor-1-11/54025)**
>
> Hello everyone, we’ve updated our app from 1.8 to 1.11 and now we have the following issue with the app deployed into GCP: MongoNetworkError: failed to connect to server \[xxx.appdomain.cloud:xxxxx\] on first connect \[Error: self signed certificate...

create a fullchain cert as per this 🙂

> <https://stackoverflow.com/questions/31673587/error-unable-to-verify-the-first-certificate-in-nodejs>

---

<div class="post-metadata">

**Author:** ![ceweithr](https://avatars.discourse-cdn.com/v4/letter/c/cdc98d/32.png) [@ceweithr](https://forums.rocket.chat/u/ceweithr)\
**Post date:** [September 29, 2021, 3:30pm UTC](https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281/10 "2021-09-29T15:30:14Z")

</div>

- Both email server and rocketchat server has no internet access and in 192.168.1.1/24.
- We create a CA certificate, and signs for many web services with it.
- All user who need to visit these web will have to install the CA to their computer first. So on Chrome we can see a green lock icon. Is that similar to the official CA function act in internet?

发件人： “John Crisp via Rocket.Chat” [rocketchat@discoursemail.com](mailto:rocketchat@discoursemail.com)  
日期： 2021年9月29日周三 22:54  
收件人： [ceweithr@163.com](mailto:ceweithr@163.com)  
主 题： [Rocket.Chat] [Community Support] RocketChat SMTP Server configure  
failed under private CA certificate signed smtp ssl certificate

---

<div class="post-metadata">

**Author:** ![ceweithr](https://avatars.discourse-cdn.com/v4/letter/c/cdc98d/32.png) [@ceweithr](https://forums.rocket.chat/u/ceweithr)\
**Post date:** [September 29, 2021, 3:24pm UTC](https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281/11 "2021-09-29T15:24:14Z")

</div>

Well, seems that we have a clue. So:

- what should I exactly do on my rocket chat docker container to use own CA file?
- Is is pointing to metor framework? Can be fixed through configuration or re compiling?

Thanks.

发件人： “John Crisp via Rocket.Chat” [rocketchat@discoursemail.com](mailto:rocketchat@discoursemail.com)  
日期： 2021年9月29日周三 23:05  
收件人： [ceweithr@163.com](mailto:ceweithr@163.com)  
主 题： [Rocket.Chat] [Community Support] RocketChat SMTP Server configure  
failed under private CA certificate signed smtp ssl certificate

---

<div class="post-metadata">

**Author:** ![dudanogueira](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/dudanogueira/32/2529_2.png) [@dudanogueira](https://forums.rocket.chat/u/dudanogueira)\
**Post date:** [October 13, 2021, 8:34pm UTC](https://forums.rocket.chat/t/rocketchat-smtp-server-configure-failed-under-private-ca-certificate-signed-smtp-ssl-certificate/12281/13 "2021-10-13T20:34:42Z")

</div>

Hey @MArtiniz1988! Welcome to our forum.

As this thread is not about API, can you open a new one?

You can check the api doc here: [https://developer.rocket.chat/reference/api](https://developer.rocket.chat/reference/api)

thanks!