# SMTP starttls certificate error

**URL:** <https://vaultwarden.discourse.group/t/smtp-starttls-certificate-error/4658>\
**Category:** Help\
**Created:** [May 21, 2025, 4:40pm UTC](https://vaultwarden.discourse.group/t/smtp-starttls-certificate-error/4658 "2025-05-21T16:40:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bfaler](https://avatars.discourse-cdn.com/v4/letter/b/eada6e/32.png) [@bfaler](https://vaultwarden.discourse.group/u/bfaler)\
**Post date:** [May 21, 2025, 4:40pm UTC](https://vaultwarden.discourse.group/t/smtp-starttls-certificate-error/4658/1 "2025-05-21T16:40:46Z")

</div>

I’m pretty sure I’m missing something obvious here.. but I’ve got vaultwarden set up using an SSL certificate (not self signed) using Caddy - Web Vault is working fine, but I’m having trouble getting SMTP work unless I turn off starttls.

Whenever I try to send a test message I get the following: SMTP error: Connection error: Connection error: error: 0A000086:SSL routines:tls\_post\_process\_server\_certificate:certificate verify failed:…/ssl/statem/statem\_clnt.c:1889: (self-signed certificate)

I’m guessing the problem is the SMTP connection is trying to use a self signed certificate rather than my actual one? Again, I can make it work if I turn off Secure SMTP - which honestly is probably OK in my case as my SMTP server is on my local network.. but I feel like I am missing something obvious here.

Can anyone offer any suggestions or point out what I am doing wrong here?

---

<div class="post-metadata">

**Author:** ![bfaler](https://avatars.discourse-cdn.com/v4/letter/b/eada6e/32.png) [@bfaler](https://vaultwarden.discourse.group/u/bfaler)\
**Post date:** [May 27, 2025, 8:21pm UTC](https://vaultwarden.discourse.group/t/smtp-starttls-certificate-error/4658/2 "2025-05-27T20:21:31Z")

</div>

A little update here in case anyone else runs into this. The problem is apparently NOT vaultwarden at all, but the SSL certificate assigned the receive connector on my Exchange server.

I found some information here about how to assign a certificate to individual connectors, and now vaultwarden is able to send email using starttls:

> **[Updating Connectors with New SSL Certificate - The Cloud Geezer](https://thecloudgeezer.com/updating-connectors-with-new-ssl-certificate/)**
>
> When you update your SSL certificate on your Exchange Servers it is also a necessary action to update both the Send and Received Connectors that have bindings. If this is not performed, then firstly you won't be able to delete the old certificate as...