Home
Index

# Trusting a mail server's certificate

If Mail can't verify the identity of a server, it’s most likely because the server's certificate is not trusted. You can specify that the certificate should be trusted and, if you want, choose a trust policy to use when trusting the certificate.

## To trust a certificate:

In the Verify Certificate dialog, click Show Certificate.

Review the certificate and decide whether to trust it or view more information about it:

■

If you're confident that the server you're trying to connect to is valid, click the "Always trust [certificate name] when connecting to [server name]" checkbox, and then continue to the last step.

■

If you want more information, click the Details disclosure triangle. If after seeing the details, you still don't want to always trust the server's certificate, continue to the next step.

Click the Trust disclosure triangle to review the current trust policies for the certificate and reset them, if you want.

When using this certificate: Indicate whether to use the system default trust policy or to override the default for this certificate by always trusting it, never trusting it, or specifying custom settings in the other options. You can learn more about trust policies in Mac Help.

Certificate trust policies

Secure Sockets Layer (SSL): Indicate whether to always or never use this trust policy. The SSL trust policy requires that the name in a server’s certificate match its DNS host name to successfully establish a connection. If there is an extended key usage field, it must contain an appropriate value.

X.509 Basic Policy: Indicate whether to always or never use the industry-standard X.509 certificate policy, which requires that the certificate be part of a chain that ends in a root certificate that is trusted on the computer you’re using.

Click Connect, and then enter your account password when prompted. If the certificate is a root certificate, you must enter the name and password of an administrator of the computer.

The certificate is now trusted on the computer you’re using.

If you want to change a certificate’s trust policy later, you can use Keychain Access.

Open Keychain Access