According to your
certutil -L -d /etc/pki/nssdb output, your nssdb is empty!
openssl s_client -showcerts -connect smtp.gmail.com:465 </dev/null you can dump the public part of the certificate of the mail server, and of any issuer certificates it may be offering. The output will be quite long, but first you should pay attention to these lines:
subject=/C=US/ST=California/L=Mountain View/O=Google LLC/CN=smtp.gmail.com
issuer=/C=US/O=Google Trust Services/CN=Google Internet Authority G3
0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=smtp.gmail.com
i:/C=US/O=Google Trust Services/CN=Google Internet Authority G3
1 s:/C=US/O=Google Trust Services/CN=Google Internet Authority G3
i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign
So, the server (
subject= line if the Server certificate part and the certificate
0 in the
Certificate chain part) is
smtp.gmail.com, and its certificate was issued by "Google Internet Authority G3". That, in turn, has got its certificate from
GlobalSign Root CA - R2.
A quick Google search with keywords "globalsign root ca R2" indicates that is a rather old certificate which will expire in 2021. If you trust it, you can download it here... but exporting a copy of "Google Internet Authority G3" certificate from your web browser's built-in standard certificate store might be a better idea.
Whichever certificate you choose, once you have it in a file, you can import it into your nssdb with
certutil -A -d /etc/pki/nssdb -i <certificate file>. (If the certificate is exported in PEM format, you may need to add the