Fix SSL certificate warnings in email clients

"The server you are connected to is using a security certificate that cannot be verified" or "Cannot verify server identity" usually means your email app connects to a server name that is not on the certificate it receives. The fix is almost always to change the server name in the account settings, not to accept the warning.

Before you start

• Open cPanel → Email → Email Accounts, click Connect Devices next to the mailbox and note the Secure SSL/TLS Settings: incoming server, outgoing server and ports.
• Know which name your app currently uses (open its account or server settings).

Why the warning appears

Many people enter mail.yourdomain.com or just yourdomain.com as the server. If that name is not covered by a valid certificate, or if DNS for mail. points elsewhere, the server presents a certificate for a different name and the app warns you. The server hostname shown in Connect Devices always has a valid certificate.

Fix it: use the recommended server name

1. In your email app open the account's server settings.
2. Set the incoming (IMAP) and outgoing (SMTP) server to the hostname shown under Secure SSL/TLS Settings in Connect Devices.
3. Use the secure ports from the table below.
4. Save and send yourself a test email.

Or make mail.yourdomain.com valid

If you prefer to use your own domain name in mail apps:

1. Check that mail.yourdomain.com points to your MdmHost server in cPanel → Domains → Zone Editor (or at your external DNS provider).
2. In cPanel → Security → SSL/TLS Status make sure mail.yourdomain.com is listed and covered by AutoSSL; select it and click Run AutoSSL if not.
3. Once covered, the mail server presents the right certificate thanks to SNI, and modern apps stop warning.

Some older mail clients do not support SNI and still see the server hostname's certificate; the hostname method above always works.

Specific apps

• Outlook (Windows): File → Account Settings → Account Settings, select the account, Change or Repair, then More Settings / Advanced for ports.
• Apple Mail (macOS): Mail → Settings → Accounts → Server Settings; untick Automatically manage connection settings to set ports.
• iPhone and iPad: Settings → Apps → Mail → Mail Accounts, the account, then the incoming and outgoing server entries.
• Android (Gmail app): account settings → Incoming settings and Outgoing settings.

Do not just accept the warning

Permanently trusting a mismatched certificate hides real problems, such as an expired certificate or a network intercepting your connection. Fix the server name instead.

Troubleshooting

• Warning appeared suddenly: the domain's DNS moved, or the certificate expired; check SSL/TLS Status.
• Works on Wi-Fi at home, fails elsewhere: a network or antivirus inspects TLS traffic.
• Password errors after changing the server: the username must be the full email address.
• Webmail shows a warning too: open webmail at https://yourdomain.com/webmail or the server hostname instead of an uncovered name.

Next steps

• Email ports for IMAP, POP3 and SMTP
• Check an installed certificate
• Fix AutoSSL problems