Other clients correctly use the same smtp server from the same machine, including openssl
Openssl shows no errors in certificates presented by the smtp server
It was, and still is, a Let’s Encrypt certificate chain on the smtp server side
History:
this setup worked fine before a gracefull sutdown of the machine for nearly 8 days (short vacation)
in that period the server certificates (Let’s Encrypt) were renewed, they show no errors and this is a normal, frequent process that never results in errors.
from the first backup after the start up of the machine it shows the MailKit error
A restart of the machine, a restart of the service, checking the smtp connection, checking the certificates, following the MailKit troubleshooting tips all look working fine and do not give any clue on what could be wrong.
What are options to investigate further? What certificate store does MailKit within Duplicati use? How to check that certificate store? How to debug this issue?
Any pointer to eable further investigation is appreciated.
Full Error message:
[Warning-Duplicati.Library.Modules.Builtin.ReportHelper-ReportSubmitError]: Failed to send message: MailKit.Security.SslHandshakeException: An error occurred while attempting to establish an SSL or TLS connection. The SSL certificate presented by the server is not trusted by the system for one or more of the following reasons: 1. The server is using a self-signed certificate which cannot be verified. 2. The local system is missing a Root or Intermediate certificate needed to verify the server’s certificate. 3. The certificate presented by the server is expired or invalid. See MailKit/FAQ.md at master · jstedfast/MailKit · GitHub for possible solutions. → System.Security.Authentication.AuthenticationException: The remote certificate was rejected by the provided RemoteCertificateValidationCallback. SslHandshakeException: An error occurred while attempting to establish an SSL or TLS connection. The SSL certificate presented by the server is not trusted by the system for one or more of the following reasons: 1. The server is using a self-signed certificate which cannot be verified. 2. The local system is missing a Root or Intermediate certificate needed to verify the server’s certificate. 3. The certificate presented by the server is expired or invalid. See MailKit/FAQ.md at master · jstedfast/MailKit · GitHub for possible solutions.
Those are good questions that I don’t have an immediate answer for. The MailKit library lives inside Duplicati, and there are no exposed logging/debugging features.
However, I did notice that Duplicati is using a rather outdated version of MailKit (2.4.1 from 2019 !).
Since that was made, a number of substantial changes have been made, including a transition to use the .NET TLS setup, so it should follow the OS key store.
My best guess as to what is happening is that LetsEncrypt has transitioned to something new (cert or TLS1.3 etc), and this is no longer working with the old MailKit library.
What I totally forgot is that I have another version running on a QNAP NAS, the Duplicati version is 2.0.8.1_beta_2024-05-07 and that one is still sending the status emails with exactly the same mail response configuration. If nothing changed in the way Mailkit is handling things and how Duplicati is handling the Mailkit elements, you would think that one should also fail.
I think the implementation of TLS on QNAP and macOS are different, so that might explain it. The 2.0.8.1 version is running with Mono, but the 2.1.0.5 is using .NETCore, so that is also a change.
And now running 2.2.0.1_stable_2025-11-09 on macOS Tahoe 26.1 since today the Mailkit message changed into:
2025-12-10 16:31:35 +01 - [Warning-Duplicati.Library.Modules.Builtin.ReportHelper-ReportSubmitError]: Failed to send message: MailKit.Security.SslHandshakeException: An error occurred while attempting to establish an SSL or TLS connection. The server's SSL certificate could not be validated for the following reasons: • The server certificate has the following errors: • An incomplete certificate revocation check occurred. --> System.Security.Authentication.AuthenticationException: The remote certificate was rejected by the provided RemoteCertificateValidationCallback. SslHandshakeException: An error occurred while attempting to establish an SSL or TLS connection. The server's SSL certificate could not be validated for the following reasons: • The server certificate has the following errors: • An incomplete certificate revocation check occurred.
The exact same config works on Ubuntu 24.04.3 LTS. And also the same email config works on the same macOS machine with other apps. No communication is blocked from the machine during the time of the backup info message. Don’t know if MailKit even tries CRL. The OCSP protocol is coming through for other apps. Stranger things!
Reviving this thread. Just started seeing the same error (MacOS Tahoe 26.5.2 (25F84)) and Duplicati 2.3.0.4 - 2.3.0.4_stable_2026-07-09. I tried changing the Advanced options to --accept-any-ssl-certificate, but then found I am unable to save the configuration.
Backups seem to be running, just suddenly can’t get any email results or save changed configurations. Anyone solved this issue?
I found this error via another path. The .NET SSL certificate validator is more strict, in that it fails if it cannot perform certificate revocation checks, where the default macOS certificate validator accepts some forms of revocation failures.
The way we set it up was to always use the .NET validator, even when there was no need. This has been fixed the current canary (2.3.0.109) and the current beta (2.3.1.0), so it always uses the system certificate validator, unless you set some certificate related options.
Besides the fixes mentioned above, there is a new option in beta 2.3.1.0: --ignore-revocation-failure to address this specific issue.
Do you get any error messages when attempting to save?
It doesn’t seem to work. I tried with 2.3.1.0 (2.3.1.0_beta_2026-07-28) on macOS Tahoe 26.6.2
With and without the option --ignore-revocation-failure=True in the individual backup options and in the general settings.
Strangely enough adding that option in general settings it adds ignore-revocation-failure=True without the two dashes completely opposite to the other settings with two dashes and in the backup options --ignore-revocation-failure=True with the two dashes which contradicts the other options that do not have two dashes. I tried both with and without the dashes.
Still got this in every case:
2026-08-22 13:40:45 +02 - [Warning-Duplicati.Library.Modules.Builtin.ReportHelper-ReportSubmitError]: Failed to send message: MailKit.Security.SslHandshakeException: An error occurred while attempting to establish an SSL or TLS connection. The server's SSL certificate could not be validated for the following reasons: • The server certificate has the following errors: • An incomplete certificate revocation check occurred. --> System.Security.Authentication.AuthenticationException: The remote certificate was rejected by the provided RemoteCertificateValidationCallback. SslHandshakeException: An error occurred while attempting to establish an SSL or TLS connection. The server's SSL certificate could not be validated for the following reasons: • The server certificate has the following errors: • An incomplete certificate revocation check occurred.
Has this issue been solved? Since my last post I now have 3 MacOS machines all throwing the same MailKit error. I’ve tried every combination of email options I can think of and also played with altering the SMTP connection string, all to no avail. Always possible that I’m still doing something wrong, but I’m at a loss. Using Duplicati 2.4.0.1_stable_2026-10-07 and MacOS Tahoe 26.6.2. Has anyone found a definitive fix?
