Mail App Certificate Error (Cannot Verify Server Identity): Fixes

A certificate warning while adding a mailbox means the name your app connected to does not match the name on the server's certificate, or the app cannot trust the certificate at all. The server is almost always fine. What is wrong is the host name you typed, the port and encryption pair, or software on your own computer that sits between the app and the server. Clicking "trust" or "continue" on a mismatch silences the warning and leaves the real mistake in place, so the account keeps failing in other ways.

Quick answer

Open the account settings and set both the incoming and outgoing server names to exactly mail.oqumail.com, not mail.yourdomain.com and not yourdomain.com. The certificate is issued for mail.oqumail.com, so any other name produces the warning. Then confirm port 993 with SSL/TLS for incoming and port 587 with STARTTLS for outgoing.

How the warning looks

• iPhone and iPad: "Cannot Verify Server Identity. The identity of mail.yourdomain.com cannot be verified."
• Outlook for Windows: "The server you are connected to is using a security certificate that cannot be verified. The target principal name is incorrect."
• Thunderbird: "Add Security Exception" dialog with "Wrong Site: The certificate belongs to a different site."
• Android mail apps: "Certificate not valid" or "Untrusted certificate" when saving the account.
• Apple Mail on Mac: "Mail can't verify the identity of the server".

Causes, most common first

• A host name other than mail.oqumail.com. Setup guides for other providers tell you to use mail.yourdomain.com; that works only when the provider issues a certificate per customer domain. OquMail uses one shared host name for everyone.
• The server of your previous provider still in the settings. After a switch, the old server answers with the old certificate or none at all.
• SSL/TLS selected on port 587. The app expects an encrypted handshake and gets plain text, which some apps report as a certificate problem. Port 587 is STARTTLS.
• Antivirus mail scanning. Avast, AVG, Kaspersky, ESET and Bitdefender can intercept mail connections and present their own certificate. The warning names the antivirus in the certificate details.
• Wrong date on the device. A clock set years off makes every certificate look expired or not yet valid.
• Captive Wi-Fi. Until you accept the hotel or airport login page, every connection is redirected and fails verification.
• Very old operating systems whose root certificate store has not been updated for years.

Fix it

1. Correct the host names first. Incoming mail.oqumail.com, outgoing mail.oqumail.com. On iPhone this is Settings, Mail, Accounts, the account, then the account name again; the SMTP server is under Outgoing Mail Server.
2. Set the ports and encryption: 993 with SSL/TLS incoming, 587 with STARTTLS outgoing. On iPhone both show as "Use SSL" on with the matching port numbers.
3. Open the certificate details in the warning. If the issuer is an antivirus product, turn off its mail shield or SSL scanning for mail and try again.
4. Check the device date and time and that you are not on a Wi-Fi network waiting for a login page.
5. Delete and re-add the account if the app keeps the old server cached; Outlook in particular remembers the first attempt.

Why not just trust the certificate?

Because the warning is correct. If the name does not match, either you are talking to the wrong server or something is intercepting the connection. Trusting it hides both. The one case where an exception is reasonable is a self-signed certificate on a server you run yourself, and that does not apply to a hosted mailbox.

Common questions

Can OquMail issue a certificate for my own domain name?

Not for mail connections. Mail apps connect to mail.oqumail.com, which has a valid certificate; your own domain appears in your address and your DNS records, not in the server name.

The warning only appears on the office network.

A corporate proxy or security appliance is inspecting the connection. Ask IT to exclude mail.oqumail.com on ports 993 and 587, or use webmail, which goes over HTTPS like any website.

It worked for months and started warning today.

Check the date on the device and whether an antivirus updated and switched mail scanning on. The server certificate renews automatically and is never the cause.