self-signed certificate (SMTP TLS) Email / SMTP Origin: Network OSI layer 6 · Presentation Last updated 4 Nov 2026

Nodemailer: Error: self signed certificate in certificate chain (code: 'ESOCKET') / unable to verify the first certificate

Nodemailer refused the SMTP server's TLS certificate because it is self-signed, expired, hostname-mismatched or missing its intermediate certificate.

Exact message you may see Error: self signed certificate in certificate chainself-signed certificate nodemailerunable to verify the first certificate nodemailerERR_TLS_CERT_ALTNAME_INVALID nodemailerHostname/IP does not match certificate's altnames
Explore the map of this error Full error map →
Seen on: SMTP Node.js SSL

Meaning

Node verifies the server certificate by default. For your own mail server, install a valid certificate (Let's Encrypt) with the full chain. In controlled test setups you can trust a specific CA with tls.ca; disabling verification (rejectUnauthorized: false) exposes passwords to man-in-the-middle attacks and should not be used in production.

Common causes

  • Self-signed certificate on the mail server
  • Certificate expired or issued for another hostname
  • Missing intermediate chain
  • Corporate TLS inspection proxy
  • Connecting by IP instead of the certificate's hostname

⚡ Quick fix

  1. Connect using the hostname in the certificate
  2. Install a trusted certificate with the full chain
  3. For internal CAs set tls: { ca: fs.readFileSync("ca.pem") }

Detailed fix by platform

Linux

  1. openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com </dev/null | openssl x509 -noout -subject -issuer -dates

Code examples

Trust your own CA (not disabling verification)

javascript
const fs = require("fs");
const t = nodemailer.createTransport({
  host: "mail.internal.example", port: 587, secure: false,
  tls: { ca: fs.readFileSync("/etc/ssl/internal-ca.pem") },
});

How to diagnose

  1. Cert — Issuer, dates and CN?
  2. Host — Matches the certificate name?
  3. Chain — Intermediates present?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

421 4.7.0 Try again later (rate limited) — SMTP: 421 4.7.0 Our system has detected an unusual rate of unsolicited mail originating from your IP address. Mail sent from your IP address has been temporarily rate limited (Email / SMTP)421 4.7.0 Try again l…530 5.7.0 Authentication Required — SMTP: 530 5.7.0 Must issue a STARTTLS command first / 530 5.7.1 Authentication required (Email / SMTP)530 5.7.0 Authenticat…Laravel: Connection could not be established with host — Laravel: Symfony\Component\Mailer\Exception\TransportException: Connection could not be established with host "smtp.mailtrap.io:2525": stream_socket_client(): Unable to connect (Email / SMTP)Laravel: Connection c…Nodemailer: EAUTH Invalid login — Nodemailer: Error: Invalid login: 535-5.7.8 Username and Password not accepted (code: 'EAUTH', responseCode: 535) (Email / SMTP)Nodemailer: EAUTH Inv…Nodemailer: ETIMEDOUT / ECONNECTION — Nodemailer: Error: connect ETIMEDOUT 142.250.27.108:465 (code: 'ETIMEDOUT', command: 'CONN') (Email / SMTP)Nodemailer: ETIMEDOUT…Nodemailer: Greeting never received — Nodemailer: Error: Greeting never received (code: 'ETIMEDOUT', command: 'CONN') (Email / SMTP)Nodemailer: Greeting …SSL: WRONG_VERSION_NUMBER (SMTP port) — SMTP: [SSL: WRONG_VERSION_NUMBER] wrong version number — SMTP over SSL on a STARTTLS port (Email / SMTP)SSL: WRONG_VERSION_NU…self-sign…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.