iPhone "Cannot Verify Server Identity": Mail and Safari fixes

"Cannot Verify Server Identity" means iOS could not confirm that the server is who it claims to be, so it asks you before sending anything. It appears most often in the Mail app with IMAP or SMTP accounts. The usual cause is a server name that does not match the certificate.

Is it the site or your device?

Usually the server or the account settings are at fault, not the phone. Find out which server name the alert mentions (tap Details). Then test that server. For mail servers, use the STARTTLS checker or OpenSSL; for websites, the SSL checker:

curl ssl.sh/example.com
openssl s_client -connect mail.example.com:993 -servername mail.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -ext subjectAltName -dates

• The certificate is valid and covers the name: check your device's date, Wi-Fi network and installed profiles.
• The certificate does not cover the name, is expired or self-signed: fix the account settings or the server.

Causes

1. Account uses a different hostname than the certificate

Shared hosting often gives you mail.example.com, but the server's certificate is for the provider's hostname (for example server123.hostingprovider.net). Use the hostname from the provider's documentation in both the incoming and outgoing server fields.

2. Self-signed or private-CA certificate

Self-hosted mail servers and NAS mail apps often use self-signed certificates. Replace them with a public certificate, or install your private root through a profile and enable full trust.

3. Expired certificate on the mail server

Mail servers are easy to forget during renewal because browsers never visit them. Renew and restart Postfix/Dovecot or the equivalent.

4. Missing intermediate on the mail server

Unlike Safari, mail protocols cannot fetch missing intermediates reliably. Configure the full chain.

5. Wrong date or intercepting network

A wrong system date or a network that intercepts TLS on mail ports produces the same alert. Enable automatic time and test on mobile data.

What it looks like on each device

How site owners fix it

A certificate that covers every published mail hostname, served with its full chain, fixes it.

1. Publish the correct server names for IMAP, POP and SMTP, and make sure the certificate covers each one.

2. Install a full-chain certificate on the mail server. For Dovecot and Postfix:

# /etc/dovecot/conf.d/10-ssl.conf
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key  = </etc/letsencrypt/live/mail.example.com/privkey.pem

# /etc/postfix/main.cf
smtpd_tls_chain_files = /etc/letsencrypt/live/mail.example.com/privkey.pem,
    /etc/letsencrypt/live/mail.example.com/fullchain.pem

3. Reload after renewal (systemctl reload dovecot postfix) and check with the STARTTLS checker and curl ssl.sh/example.com for the web side.