gmail and certs

[precords]

Hello,
Having a difficult time in migrating servers here. Gmail is throwing up some junk when connecting. Certificate stuff.

Warning: stream_socket_enable_crypto(): SSL operation failed with code 1.
OpenSSL Error messages: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

Phpmailer will work though for smtp.domain1.com and sending mail from example@domain1.com when smtp.domain1.com is SSLed and configured. I'm planning on a multi-domain cert to replace self signed stuff which is what is available on CWP servers. Hoping this will solve smtp.gmail problems. Specifically what exactly needs to be SSLed on the server? My server name is cp.domain.com I run multiple domains on it: domain1.com and domain2.com. I'm trying to send emails with smtp.gmail.com on domain1.com. So what do I need here as far as SSL certs?

mail.domain1.com ?
smtp.domain1.com ?
domain1.com ?
cp.domain.com ?

Not sure what phpmailer needs here to run correctly with gmail and what exactly needs SSL.

And does a wildcard cert work or should it be FQDN?

running php 5.6.37 fpm on domain1.com so that my shopping cart which is no longer supported continues to run as it does with this config on my old server. By the way all of this code continues to operate perfectly fine with my gmail phpmailer on my old server so I know nothing is outdated and won't work. I have gmail app password now on both and old server mails without any problems.

Thank you for help here as I didn't see specifics in documentation of what phpmailer uses when doing TLS smtp connections.

precords

[Synchro]

This is likely caused by outdated CA certificates on your server. This is covered extensively in the troubleshooting guide. It has nothing to to do with your site's certificate, it's that it lacks the correct certificate chains it needs to be able to verify Google's certificate when it connects over SMTP.

You would normally update your CA certificate bundle via regular OS package updates, but if your OS is no longer receiving updates (which may be the case given that you're also running an ancient PHP version), you'll need to update them manually, which is covered in the guide.

BTW, Thanks very much for your sponsorship!

[precords]

So smtp.gmail.com tls does not use my server's SSL, only the cacert.pem that must be updated?

[precords]

Ok so when I set the cacert.pem in etc/ssl/cacert.pem folder I can now get my test to work but now only with this code

$mail->SMTPOptions = array(
'ssl' => array(
'verify_peer' => false,
'verify_peer_name' => false,
'allow_self_signed' => true
)
);

Which means now I need some SSL on my server. But I still don't know WHAT needs to be SSLed???

Please reply to this specific question. Is it domain1.com?
Is it mail.domain1.com?
Is it smtp.domain1.com?
Is it the host cp.domain.com??

Thank you,
Would rather do this correctly and not turn off validation here.

[precords]

Ok, so no SSL needs to be on your server at all. You can connect to smtp.gmail.com with phpmailer and a current cacert.pem in the etc/ssl/cacert.pem place. You can get a current cacert.pem following the instruction in the manual
https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting#certificate-verification-failure

or you can do this by SSH

wget https://curl.se/ca/cacert.pem -P /var/tmp/
mv /var/tmp/cacert.pem /etc/ssl/certs/cacert.pem

Modify your php.ini and change these lines:

openssl.cafile = /etc/ssl/cacert.pem
curl.cainfo = /etc/ssl/cacert.pem

Then you must restart or reload you PHP

Then all will work