I'm trying to send mail via SMTP server. And set /etc/mail.rc file with:

set bsdcompat
set smtp=smtps://smtp.gmail.com:465
set smtp-auth=login
set smtp-auth-user=user@gmail.com
set smtp-auth-password=password
set ssl-verify=ignore
set nss-config-dir=/etc/pki/nssdb/

Now I'm able to send mail, but I'm getting an error like:

Error in certificate: Peer's certificate issuer is not recognized.

following entries are present in my nssdb:

certutil -L -d /etc/pki/nssdb

Certificate Nickname Trust Attributes 

Can anyone please suggest me a solution for this? I have googled, but didn't get a correct solution.

  • I assume that isn't a real user name and password you posted, right?
    – terdon
    May 22 '18 at 13:18

According to your certutil -L -d /etc/pki/nssdb output, your nssdb is empty!

With openssl s_client -showcerts -connect smtp.gmail.com:465 </dev/null you can dump the public part of the certificate of the mail server, and of any issuer certificates it may be offering. The output will be quite long, but first you should pay attention to these lines:

Server certificate
subject=/C=US/ST=California/L=Mountain View/O=Google LLC/CN=smtp.gmail.com
issuer=/C=US/O=Google Trust Services/CN=Google Internet Authority G3


Certificate chain
 0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=smtp.gmail.com
   i:/C=US/O=Google Trust Services/CN=Google Internet Authority G3
 1 s:/C=US/O=Google Trust Services/CN=Google Internet Authority G3
   i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign

So, the server (subject= line if the Server certificate part and the certificate 0 in the Certificate chain part) is smtp.gmail.com, and its certificate was issued by "Google Internet Authority G3". That, in turn, has got its certificate from GlobalSign Root CA - R2.

A quick Google search with keywords "globalsign root ca R2" indicates that is a rather old certificate which will expire in 2021. If you trust it, you can download it here... but exporting a copy of "Google Internet Authority G3" certificate from your web browser's built-in standard certificate store might be a better idea.

Whichever certificate you choose, once you have it in a file, you can import it into your nssdb with certutil -A -d /etc/pki/nssdb -i <certificate file>. (If the certificate is exported in PEM format, you may need to add the -a option.)


It seems that your local system is missing certificates. Over on Server Fault is an answer to this same question.

smtp.gmail.com from bash gives "Error in certificate: Peer's certificate issuer is not recognized."

  • 2
    Please don't post link-only answers. If the other site goes away your answer becomes worthless. Instead, please extract the relevant parts and add them to your answer here. (It's good still to reference the original source, to give credit.)
    – roaima
    May 22 '18 at 6:20
  • that post is not helping me.. May 22 '18 at 6:27
  • certutil -L -d /etc/pki/nssdb Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI above certificates are present in my nssdb . May 22 '18 at 6:30
  • 1
    The error message suggests a problem with the certificates but your question doesn't contain enough information to diagnose the exact problem. Please edit your question to include full details.
    – tripleee
    May 22 '18 at 6:47
  • edited @tripleee May 22 '18 at 10:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.