Mail server's TLS certificate has expired or is not yet valid
Updated
What this check looks for
The certificate your mail server presents is outside its validity dates. Senders that verify certificates will refuse to deliver mail to you.
Why it matters
An expired certificate on a web server produces a warning a visitor can click through. On a mail server there is nobody to click: an enforcing sender simply stops delivering, and the mail queues until it bounces.
When the check passes, your report says: “The mail server's certificate is within its validity dates”.
What it costs your score
When this check fails it removes 20 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.
It shares the email-transport.smtp-tls family ceiling of 40 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 20 points
- Family cap
- email-transport.smtp-tls · 40
- Category
- Email transport
- Module
- Email smtp tls
- Fix owned by
- mail provider
- In the ruleset since
- 2026.09
How to fix it
Renew the certificate and reload the mail server so the new one is actually served.
An expired certificate stops delivery from every sender that verifies, and those are the large ones.
Renew:
certbot renewor your CA's equivalent.Reload the mail server — Postfix
postfix reload, Eximsystemctl reload exim4. Renewing without reloading is why this recurs.Add the reload to the renewal hook (
--deploy-hook) so it happens automatically every time.Set a calendar reminder or monitoring alert at 14 days before expiry.
How to confirm it worked
openssl s_client -starttls smtp -connect ‹mx host›:25 -servername ‹mx host› 2>/dev/null | openssl x509 -noout -dates — expect a notAfter date in the future.
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The certificate presented by ‹mx host› has ‹days remaining› days remaining. A renewal that succeeded but was never loaded is the usual cause: the file on disk is current and the running process still holds the old one.
‹verification error›
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.