Duplicati complains about warning, but there is no warning, except

I am getting the following error in the generic log:

{"ClassName":"MailKit.Security.SslHandshakeException","Message":"An error occurred while attempting to establish an SSL or TLS connection.\n\nThe SSL certificate presented by the server is not trusted by the system for one or more of the following reasons:\n1. The server is using a self-signed certificate which cannot be verified.\n2. The local system is missing a Root or Intermediate certificate needed to verify the server's certificate.\n3. The certificate presented by the server is expired or invalid.\n\nSee https://github.com/jstedfast/MailKit/blob/master/FAQ.md#InvalidSslCertificate for possible solutions.","Data":null,"InnerException":{"ClassName":"System.Security.Authentication.AuthenticationException","Message":"Authentication failed, see inner exception.","Data":null,"InnerException":{"Alert":{"Level":"Fatal","Description":"CertificateUnknown","Message":"The authentication or decryption has failed.","IsWarning":false,"IsCloseNotify":false},"Message":"CertificateUnknown","Data":{},"InnerException":null,"StackTrace":" at Mono.AppleTls.AppleTlsContext.EvaluateTrust () [0x000d1] in <b5770dddf7a049e4a3f693b1ca2b5796>:0 \n at Mono.AppleTls.AppleTlsContext.ProcessHandshake () [0x0004e] in <b5770dddf7a049e4a3f693b1ca2b5796>:0 \n at Mono.Net.Security.MobileAuthenticatedStream.ProcessHandshake (Mono.Net.Security.AsyncOperationStatus status, System.Boolean renegotiate) [0x000a1] in <b5770dddf7a049e4a3f693b1ca2b5796>:0 \n at (wrapper remoting-invoke-with-check) Mono.Net.Security.MobileAuthenticatedStream.ProcessHandshake(Mono.Net.Security.AsyncOperationStatus,bool)\n at Mono.Net.Security.AsyncHandshakeRequest.Run (Mono.Net.Security.AsyncOperationStatus status) [0x00006] in <b5770dddf7a049e4a3f693b1ca2b5796>:0 \n at Mono.Net.Security.AsyncProtocolRequest.ProcessOperation (System.Threading.CancellationToken cancellationToken) [0x000ff] in <b5770dddf7a049e4a3f693b1ca2b5796>:0 \n at Mono.Net.Security.AsyncProtocolRequest.StartOperation (System.Threading.CancellationToken cancellationToken) [0x0008b] in <b5770dddf7a049e4a3f693b1ca2b5796>:0 ","HelpLink":null,"Source":"mscorlib","HResult":-2146233088},"HelpURL":null,"StackTraceString":" at Mono.Net.Security.MobileAuthenticatedStream.AuthenticateAsClient (System.String targetHost, System.Security.Cryptography.X509Certificates.X509CertificateCollection clientCertificates, System.Security.Authentication.SslProtocols enabledSslProtocols, System.Boolean checkCertificateRevocation) [0x0004b] in <b5770dddf7a049e4a3f693b1ca2b5796>:0 \n at System.Net.Security.SslStream.AuthenticateAsClient (System.String targetHost, System.Security.Cryptography.X509Certificates.X509CertificateCollection clientCertificates, System.Security.Authentication.SslProtocols enabledSslProtocols, System.Boolean checkCertificateRevocation) [0x00006] in <b5770dddf7a049e4a3f693b1ca2b5796>:0 \n at MailKit.Net.Smtp.SmtpClient.ConnectAsync (System.String host, System.Int32 port, MailKit.Security.SecureSocketOptions options, System.Boolean doAsync, System.Threading.CancellationToken cancellationToken) [0x005de] in <044c7cb38b61487086ccf0eae49cb447>:0 ","RemoteStackTraceString":null,"RemoteStackIndex":0,"ExceptionMethod":null,"HResult":-2146233087,"Source":"System"},"HelpURL":"https://github.com/jstedfast/MailKit/blob/master/FAQ.md#InvalidSslCertificate","StackTraceString":" at MailKit.Net.Smtp.SmtpClient.ConnectAsync (System.String host, System.Int32 port, MailKit.Security.SecureSocketOptions options, System.Boolean doAsync, System.Threading.CancellationToken cancellationToken) [0x0068a] in <044c7cb38b61487086ccf0eae49cb447>:0 \n at Duplicati.Library.Modules.Builtin.SendMail.SendMessage (System.String subject, System.String body) [0x00581] in <9d5149643472404bbb0e7999293b9e6f>:0 \n at Duplicati.Library.Modules.Builtin.ReportHelper.OnFinish (System.Object result) [0x00135] in <9d5149643472404bbb0e7999293b9e6f>:0 ","RemoteStackTraceString":null,"RemoteStackIndex":0,"ExceptionMethod":null,"HResult":-2146233088,"Source":"Duplicati.Library.Modules.Builtin"}

Not as part of the backup set but as general error. I am sending an email message on each backup with th ereport, but this fails. Note: ‘show’ doesn’t show the correct log, as this is in the Duplicati-wide log not the backup-set specific log. But what I am wondering about is that all 3 reasons seem not to be the case. The mail server (which one is Duplicati connecting to anyway?) is protected by an up-to-date Letsencrypt certificate. So, what is going on here?

Did u restarted postfix/dovecot (or whatever combo u use) service after lets encrypt renew? Certbot does restart apache after renew but not mailserver itself.

The mail server (postfix & dovecot) is working fine. The server is up for 15 days, but postfix & dovecot have been restarted a couple of times in that period; the cert was last renewed on Jan 5.

Where does Duplicati connect to when trying to send that mail?

I am going to drop it. Storing mail credentials in Duplicati is not secure. Sending mail to myself when outside my LAN requires credentials or opening up my mail server as an open relay (I think not). So, I’m going to drop sending mail for now.