title: MailX: "Error in certificate: Peer's certificate issuer has been marked as not trusted by the."
body: <p>I am trying to send an alert programmatically. The alert will be sent using a system. In this case, it is Cloudera Alert Publisher. Cloudera Alert Publisher sends system alerts to the admin team. </p>
  
  <p>Here I have the configuration issue. </p>
  
  <p>The biggest issue comes from security. From the security perspective, when a user wants to use email services, encryption and authentication are needed. Encryption makes me a headache. I am not knowing much about encryption. </p>
  
  <p>Per my understanding, most of Email services use TLS encryption. They will register themselves in a commercial CA (certificate authority). Email providers submit a CSR ( certificate signing request ) to a commercial CA and get a service certificate and store it to authenticate the service to the client. </p>
  
  <p>The certificate chain is used for service authentication. In the client side, the user program will store the CA certificate. The user program will examine the service certificate and check if the service certificate issuer is the trusted commercial CA. When the authentication is done, encryption will begin based on the private key and public key. </p>
  
  <p>For the browser clients, usually all the popular browsers like Chrome, Firefox, they have installed the popular CA certificate already. The web email users don't need to install the commercial CA. So the web email users can start a TLS connection directly. </p>
  
  <p>I am not the browser email user, I am using client tool. What I need to figure out are:
  1) What is the commercial CA of that specific email service?
  2) How can I get the CA certificate from the commercial CA?
     2.1) Gmail
     2.2) mail.com
  3) What directory do I need to install the CA certificate for mainstream tools?
     3.1) JAVA MAILX
     3.2) Linux MAILX</p>
  
  <p>Can you please clarify more about this scenarios? 
  1) How many approaches to do this and what are they? 
  2) What more do I need to consider? </p>
  
  <p>I have a case here. I use <code>mailx</code> to send a test mail to <code>mail.com</code> SMTP server. <code>mailx</code> client scipt is as follows.</p>
  
  <pre><code>echo "This is the message body and contains the message" | mailx -v -r "name.surname@gmail.com" -s "This is the subject" -S smtp="smtp.mail.com:587" -S smtp-use-starttls -S smtp-auth=login -S smtp-auth-user="name.surname@mail.com" -S smtp-auth-password="*****" -S ssl-verify=ignore -S nss-config-dir="/etc/pki/nssdb" name.surname@gmail.com
  </code></pre>
  
  <p>And the error msgs show service certificate issuer is not trusted. </p>
  
  <pre><code>&gt;&gt;&gt;Resolving host smtp.mail.com . . . done.
  Connecting to 74.208.5.15:587 . . . connected.
  220 gmx.com (mrgmxus002) Nemesis ESMTP Service ready
  &gt;&gt;&gt; EHLO ip-172-29-1-106.eu-west-1.compute.internal
  250-gmx.com Hello ip-172-29-1-106.eu-west-1.compute.internal [52.213.120.236]
  250-AUTH LOGIN PLAIN
  250-SIZE 69920427
  250 STARTTLS
  &gt;&gt;&gt; STARTTLS
  220 OK
  Error in certificate: Peer's certificate issuer has been marked as not trusted by the.
  Comparing DNS name: "smtp.mail.com"
  SSL parameters: cipher=missing, keysize=256, secretkeysize=256,
  issuer=CN=thawte SSL CA - G2,O="thawte, Inc.",C=US
  subject=CN=smtp.mail.com,O=1&amp;1 Mail &amp; Media Inc.,L=Chesterbrook,ST=Pennsylvania,C=US
  &gt;&gt;&gt; EHLO ip-172-29-1-106.eu-west-1.compute.internal
  250-gmx.com Hello ip-172-29-1-106.eu-west-1.compute.internal [52.213.120.236]
  250-AUTH LOGIN PLAIN
  250 SIZE 69920427
  &gt;&gt;&gt; AUTH LOGIN
  334 VXNlcm5hbWU6
  &gt;&gt;&gt; ZG9uZy5jaGVuQG1haWwuY29t
  334 UGFzc3dvcmQ6
  &gt;&gt;&gt; Y2R+MTExMTEx
  235 Authentication succeeded
  &gt;&gt;&gt; MAIL FROM:&lt;chendong.jy@gmail.com&gt;
  550-Requested action not taken: mailbox unavailable
  smtp-server: 550-Requested action not taken: mailbox unavailable
  550 Sender address is not allowed.
  smtp-server: 550 Sender address is not allowed.
  "/root/dead.letter" 11/366
  . . . message not sent.250-SIZE 69920427
  250 STARTTLS
  &gt;&gt;&gt; STARTTLS
  220 OK
  Error in certificate: Peer's certificate issuer has been marked as not trusted by the.
  Comparing DNS name: "smtp.mail.com"
  </code></pre>