MAILER ERROR 140

[Stephan-P]

Extending the environment.yaml of my pretty fresh setup, my Sync-in log shows an error re. MAILER
Sync-in log :

sync-in  | [2026-06-05 14:40:02] ERROR (140): [MAILER] Unable to use Mail Server at web0109.zxcs.nl:465 (secure: true) : Error: unable to verify the first certificate; if the root CA is installed locally, try running Node.js with --use-system-ca

environment.yaml snippet:

mail:
  host: web0109.zxcs.nl
  port: 465  # default: `25`
  sender: 'Sync-in<sync-in@MYDOMAIN.TLD>'
  # optional
  auth:
    user: ACCOUNT@MYDOMAIN.TLD
    pass: PASSWORD
  # Defines if the connection should use SSL (if true) or not (if false)
  # Note: setting `secure: false` does not necessarily mean messages are sent in plaintext
  # If the server supports STARTTLS, the connection is usually upgraded to TLS automatically
  secure: true
  # ignoreTLS: if true, disables the use of STARTTLS even if the server advertises it
  ignoreTLS: false
  # rejectUnauthorized: reject the connection if the server's TLS certificate is invalid
  rejectUnauthorized: false
  # Enable logger
  logger: false
  # Set log level to debug
  debug: false

Is there anything that I can do here?
Other mail clients have no problem whatsoever with these smtp settings.

[yudin-s]

This looks like Node is rejecting the TLS certificate chain presented by the SMTP server before Sync-in gets to the actual mail send step.

For port 465 your secure: true shape is the right one, so I would not change this to ignoreTLS. First check the certificate chain from the same host/container network that runs Sync-in:

openssl s_client -connect web0109.zxcs.nl:465 -servername web0109.zxcs.nl -showcerts </dev/null

Look at the final Verify return code. If it is not 0 (ok), the mail server is probably not presenting the full intermediate chain, or it uses a CA that is not in the container trust store.

Practical fixes, in order:

1. Fix the SMTP server certificate/full-chain in the hosting panel if you control it.
2. If it uses a private/custom CA, mount that CA into the container and point Node at it with NODE_EXTRA_CA_CERTS=/path/to/ca.pem.
3. If you try port 587, use secure: false so STARTTLS is negotiated, but the same CA-chain problem can still appear.

I would only use tls.rejectUnauthorized: false as a brief diagnostic, not as the fix, because it masks the trust-chain problem. If the openssl check shows the same verify error, that is the layer I would fix first.

If that solves the mail setup, please mark the answer so the certificate-chain fix is easy to find later.

[Stephan-P]

Result for openssl s_client -connect web0109.zxcs.nl:465 -servername web0109.zxcs.nl -showcerts </dev/null

Connecting to 2a06:2ec0:1::109
CONNECTED(00000003)
depth=0 CN=*.zxcs.nl
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN=*.zxcs.nl
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN=*.zxcs.nl
verify return:1

Result for openssl s_client -connect web0109.zxcs.nl:587 -servername web0109.zxcs.nl -showcerts </dev/null

Connecting to 2a06:2ec0:1::109
CONNECTED(00000003)
80B7EE9F477F0000:error:0A00010B:SSL routines:tls_validate_record_header:wrong version number:../ssl/record/methods/tlsany_meth.c:77:
---
no peer certificate available
---
No client certificate CA names sent
Negotiated TLS1.3 group: <NULL>
---
SSL handshake has read 5 bytes and written 1557 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Protocol: TLSv1.3
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

This server is at an ISP (vimexx.nl), so I can only file a problem report there.

Changing to port 587 in environment.yaml

mail:
  host: web0109.zxcs.nl
  port: 587  # default: `25`
  sender: 'Sync-in<sync-in@MYDOMAIN.TLD>'
  # optional
  auth:
    user: ACCOUNT@MYDOMAIN.TLD
    pass: PASSWORD
  # Defines if the connection should use SSL (if true) or not (if false)
  # Note: setting `secure: false` does not necessarily mean messages are sent in plaintext
  # If the server supports STARTTLS, the connection is usually upgraded to TLS automatically
  secure: false
  # ignoreTLS: if true, disables the use of STARTTLS even if the server advertises it
  ignoreTLS: false
  # rejectUnauthorized: reject the connection if the server's TLS certificate is invalid
  rejectUnauthorized: false  # default: `false`
  # Enable logger
  logger: false
  # Set log level to debug
  debug: false

Snippet of Sync-in log after Docker UP

sync-in    | [2026-06-06 14:55:33] ERROR (113): [MAILER] Unable to use Mail Server at web0109.zxcs.nl:587 (secure: false) : Error: unable to verify the first certificate; if the root CA is installed locally, try running Node.js with --use-system-ca

[Stephan-P]

I submitted a support ticket at Vimexx.nl as well.

Mind you, Vivaldi Mail and Thunderbird Mail have no issues connecting to this SMTP server (586 or 465).

[Stephan-P]

GOT IT!

As an alternative to the generic mail server url (which is prescribed by my ISP) there's also the url mail.my-domian.tld that is forwarded to it.
After making the following change in environment.yaml

mail:
  host: mail.my-domain.tld

The Sync-in log shows:

sync-in    | [2026-06-06 15:29:16] INFO (101): [MAILER] Using Mail Server at mail.my-domain.tld:587 (secure: false)

So I guess that fixed it (for port 587)
How can I make Sync-in to send out an email?

[Stephan-P]

I briefly tried port 465, but that lead to the error message "Greeting not received"
Back to port 587, which is receiving a positive confirmation

[Stephan-P]

My ISP confirms what I had discovered:

Dear Stephan, Thank you for your message. As a host you can use mail.zxcs.nl or the mail subdomain of your domain name (i.e. mail.[example.nl]). There is a certificate active on that! This will have to work neatly on ports 465 and 587. If you have any further questions, we will be happy to help you with this!

[Stephan-P]

Great help from @yudin-s
Issue resolved after some further experimenting with an alternative url for mail.host