Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

First off, I'm not a server admin, I'm by no means an expert.

So, there are two servers, one is used for email relaying and the other runs a website. The website will use .NET to send a message through SMTP with UseSSL flagged. However it fails due to the error

The remote certificate is invalid according to the validation procedure.

So I enabled tracing and the log outputted this message

System.Net Information: 0 : [4656] SecureChannel#22800124 - Remote certificate has errors: System.Net Information: 0 : [4656] SecureChannel#22800124 - A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

System.Net Information: 0 : [4656] SecureChannel#22800124 - Remote certificate was verified as invalid by the user.

System.Net Error: 0 : [4656] Exception in the SmtpClient#34708722::Send - The remote certificate is invalid according to the validation procedure.

So we double checked, and the certificate on the email server was expired. Someone created a new self signed certificate on the email server, and it was imported to the trusted root certificate authority on the web server. That didn't fix the error.

Any ideas on what else I can check? Or was that not how you set a certificate to be trusted?

Also, when not using SSL the application works fine, and nothing should be wrong with the application itself, as it use to work up until a little while ago (when the old certificate expired) and it can run fine on other servers.

share|improve this question

3 Answers 3

I think that you need to restart IIS to reload the certificate keystore.

You can also check the remote certificate with:

openssl s_client -connect SMTPserver:port|openssl x509 -text

You can find openssl at http://www.openssl.org/related/binaries.html

share|improve this answer
    
+1, Thanks for the answer. I'm unable to test this until tomorrow, I will let you know then. –  Brandon Feb 18 '10 at 18:43

You can also use http://www.sslshopper.com/ssl-checker.html to make sure that the server is giving out the correct intermediate certificates and doesn't have any other errors.

share|improve this answer

This is probably the best online tutorial that I have found on using the s_client feature of the openssl toolchain.

Check out The OpenSSL Command-Line Howto by Paul Heinlein.

All of Paul's guides are great, but this one stands out for giving you a great walk through of all the tools that you can use to manage and/or troubleshoot your SSL certificate issues.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.