# Nodemailer: Error: self signed certificate in certificate chain (code: 'ESOCKET') / unable to verify the first certificate

**Code:** `self-signed certificate (SMTP TLS)` · **Category:** Email / SMTP · **Seen on:** SMTP, Node.js, SSL

Nodemailer refused the SMTP server's TLS certificate because it is self-signed, expired, hostname-mismatched or missing its intermediate certificate.

## Meaning

Node verifies the server certificate by default. For your own mail server, install a valid certificate (Let's Encrypt) with the full chain. In controlled test setups you can trust a specific CA with `tls.ca`; disabling verification (`rejectUnauthorized: false`) exposes passwords to man-in-the-middle attacks and should not be used in production.

## Common causes

- Self-signed certificate on the mail server
- Certificate expired or issued for another hostname
- Missing intermediate chain
- Corporate TLS inspection proxy
- Connecting by IP instead of the certificate's hostname

## Quick fix

1. Connect using the hostname in the certificate
2. Install a trusted certificate with the full chain
3. For internal CAs set `tls: { ca: fs.readFileSync("ca.pem") }`

## Detailed fix by platform

### Linux

1. `openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com </dev/null | openssl x509 -noout -subject -issuer -dates`

## Code examples

### Trust your own CA (not disabling verification)

```javascript
const fs = require("fs");
const t = nodemailer.createTransport({
  host: "mail.internal.example", port: 587, secure: false,
  tls: { ca: fs.readFileSync("/etc/ssl/internal-ca.pem") },
});
```

## How to diagnose

1. **Cert** — Issuer, dates and CN?
2. **Host** — Matches the certificate name?
3. **Chain** — Intermediates present?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/email/nodemailer-self-signed-certificate)