# SMTP STARTTLS Manual Cert

**URL:** <https://forum.inductiveautomation.com/t/smtp-starttls-manual-cert/107725>\
**Category:** Ignition\
**Tags:** ignition81\
**Created:** [June 24, 2025, 4:11pm UTC](https://forum.inductiveautomation.com/t/smtp-starttls-manual-cert/107725 "2025-06-24T16:11:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![AIO](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/aio/32/87549_2.png) [@AIO](https://forum.inductiveautomation.com/u/AIO)\
**Post date:** [June 24, 2025, 4:11pm UTC](https://forum.inductiveautomation.com/t/smtp-starttls-manual-cert/107725/1 "2025-06-24T16:11:28Z")

</div>

Good morning, folks.

Just wanted to quickly share here, since I've never run into this and I am certain I won't be the only one.

Client's IT department configured a Classic SMTP profile with "Use STARTTLS" enabled. Test sends gave the following error:

```python
javax.mail.MessagingException: Could not convert socket to TLS; nested exception is: 
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

```

In order to resolve this, I wound up using OpenSSL to get the certificate, saving it to the Ignition certificate directory, and restarting the gateway. Detailed steps just for reference.

- Run the following openssl command to get certificate

```python
"openssl s_client -connect your.smtp.hostname:port -starttls smtp"

```

- Read output and copy the cert (including the begin / end header and footer). ie:

```python
-----BEGIN CERTIFICATE----- 
several lines of characters
-----END CERTIFICATE-----

```

- Paste cert into new text file, save with `.pem` extension
- Move .pem file to Ignition supplemental certificate location

```python
`%gateway installation directory%data/certificates/supplemental`

```

- Restart gateway

---

<div class="post-metadata">

**Author:** ![SolarNomad](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@SolarNomad](https://forum.inductiveautomation.com/u/SolarNomad)\
**Post date:** [August 5, 2025, 11:57pm UTC](https://forum.inductiveautomation.com/t/smtp-starttls-manual-cert/107725/2 "2025-08-05T23:57:47Z")

</div>

Thank you for sharing, I am running into a similar issue. Regarding the cert, are you referring to the ignition webserver cert or a cert you got from your IT that is from the SMTP server.

---

<div class="post-metadata">

**Author:** ![AIO](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/aio/32/87549_2.png) [@AIO](https://forum.inductiveautomation.com/u/AIO)\
**Post date:** [August 6, 2025, 4:15pm UTC](https://forum.inductiveautomation.com/t/smtp-starttls-manual-cert/107725/3 "2025-08-06T16:15:43Z")

</div>

I used OpenSSL to get the cert from the SMTP server (which IT owns and manages).