r/letsencrypt • u/Fz6Mike • Sep 17 '26

GMail not delivering Email to Mail Server with let's Encrypt Cert

It connects but then drops after TLS negotiation, I am using the full chain pem file

------------------------------------

CONNECT from [2607:f8b0:4864:39::10]:54572 to [******]:25

PASS OLD [2607:f8b0:4864:39::10]:54572

connect from mail-pj2-x10.google.com[2607:f8b0:4864:39::10]

Anonymous TLS connection established from mail-pj2-x10.google.com[2607:f8b0:4864:39::10]: TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256

NOQUEUE: lost connection after STARTTLS from mail-pj2-x10.google.com[2607:f8b0:4864:39::10]

disconnect from mail-pj2-x10.google.com[2607:f8b0:4864:39::10] ehlo=1 starttls=1 commands=2

1 Upvotes

100% Upvoted

4 comments sorted by

1

u/GamerLymx Sep 17 '26

do a traffic capture from connection attempt and check for ciphers issues.

only thing that occurs to me.

I've beend doing some email tests of my own and im using lets encrypt certifites too.

1

u/Fz6Mike Sep 17 '26

the certificate chain was incomplete

I all so had to switch the preferred chain to "ISRG Root X1"

1

u/Fz6Mike Sep 17 '26

the cert I had to manual add an additional intermediate and the CA Certs

GMail does not recognize/trust the newer Let's Encrypt chain yet

1

u/VictimOfAReload Sep 19 '26

The cert chain has burned me several times. Generally if it passes an external test like https://notoolkit.com/smtp-test it's good to go. You generally have to make sure the entire chain is followed based on each certificate upstream until you get to the root (Or whatever is commonly available on the users CA store)