Hostgator nodemailer ERR_TLS_CERT_ALTNAME_INVALID

user_954986 0
Viewed 122

I configured nodemailer to send to hostgator (as I learned how to here: https://stackoverflow.com/a/56291143/954986):

const transporter = nodemailer.createTransport(smtpTransport({
  name: "hostgator",
  host: "mail.mysite.com",
  port: 465,
  secure: true,
  auth: {
    user: "test@mysite.com",
    pass: $password,
  }
}));

However, when sending messages I'm getting: Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames: Host: mail.mysite.com. is not in the cert's altnames: DNS:*.hostgator.com, DNS:hostgator.com

It only works when I add tls: { rejectUnauthorized: false}, which I would like to avoid.

The weird thing is that when I use any online SSL checker to look up "mail.mysite.com" it shows that SSL is configured correctly, and my site domain shows up in the certificate.

It seems like somehow hostgator is serving a different certificate for my supplied host? Any idea what might be happening, or how I can dig deeper into this?

Interesting update: I did some more digging, and found the domain "cloud64.hostgator.com". I used this as the transportor host instead of mail.mysite.com, and it works with TLS enabled! And the email even sends faster.

I want to understand this though. Is this a stable host I can continue using? Is there some sort of redirect happening at the SMTP layer? What's going on?

nodemailer smtp ssl
1 Answers

From what I see you are connecting to:

  1. In the first case, where you are getting *.hostgator.com TSL certificate, which is not valid for your domain thus your TSL validation fails.

  2. In second scenario you are using cloud64.hostgator.com which probably has some generic MX record so your domain will work. Which is kind of weird, but I can imagine hacking it up somehow.

It seems to me you have incorrect DNS MX record(s) set for your domain. You have to correctly add the MX record(s) so the certificate will be matched to your domain when connecting via TLS SMTP.

For hostgator you can setup MX records like this.

Of course, if you want you can also read RFC974 - the mail routing with domain system and the RFC8314 - on TLS security which gives you details how it should work.

Note: What version of TLS will be supported depends on the negotiation between server and client. They will both agree on the highest common denominator. The latest is TLSv1.3.

user_60598960
Related