dotvitals

Mail server's TLS certificate has expired or is not yet valid

HighConfirmedQuick winemail.smtp-tls.certificate-expired

What this check looks for

The certificate your mail server presents is outside its validity dates. Senders that verify certificates will refuse to deliver mail to you.

Why it matters

An expired certificate on a web server produces a warning a visitor can click through. On a mail server there is nobody to click: an enforcing sender simply stops delivering, and the mail queues until it bounces.

When the check passes, your report says: “The mail server's certificate is within its validity dates”.

What it costs your score

When this check fails it removes 20 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.

It shares the email-transport.smtp-tls family ceiling of 40 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.

Severity
high
Default confidence
confirmed
Status when triggered
fail
Deduction
20 points
Family cap
email-transport.smtp-tls · 40
Category
Email transport
Module
Email smtp tls
Fix owned by
mail provider
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Renew the certificate and reload the mail server so the new one is actually served.

An expired certificate stops delivery from every sender that verifies, and those are the large ones.

  1. Renew: certbot renew or your CA's equivalent.

  2. Reload the mail server — Postfix postfix reload, Exim systemctl reload exim4. Renewing without reloading is why this recurs.

  3. Add the reload to the renewal hook (--deploy-hook) so it happens automatically every time.

  4. Set a calendar reminder or monitoring alert at 14 days before expiry.

How to confirm it worked

  • openssl s_client -starttls smtp -connect ‹mx host›:25 -servername ‹mx host› 2>/dev/null | openssl x509 -noout -dates — expect a notAfter date in the future.

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

The certificate presented by ‹mx host› has ‹days remaining› days remaining. ‹verification error› A renewal that succeeded but was never loaded is the usual cause: the file on disk is current and the running process still holds the old one.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email smtp tls checker

Other email smtp tls checks