Email clients (Outlook, Apple Mail, Thunderbird) showing a certificate trust warning when connecting to a mail server most commonly indicates the mail server's certificate doesn't cover the exact hostname the client is configured to connect to — a separate certificate from your website's, easy to overlook since it's configured independently.
The fix
Confirm the certificate installed on your mail server (Postfix/Dovecot or equivalent) has a SAN entry matching the exact hostname configured in mail client settings (often mail.yourdomain.com), and that it's not simply reusing your website's certificate, which may not include that specific hostname.
What makes mail server certificate trust issues sometimes harder to diagnose than web ones
Email clients often provide less detailed error messaging than browsers, and mail server certificate issues can affect SMTP, IMAP, and POP3 independently, meaning the same underlying certificate might work for one mail protocol while a separate, inconsistently updated configuration causes a warning for another.
How to check mail server certificate details directly without relying on the email client's own display
Connecting directly to your mail server's specific port with OpenSSL's s_client and the appropriate STARTTLS flag shows the actual certificate details independent of any particular email client's own summarized display, giving a more direct, reliable view of what's actually being presented.
What specific settings differ between IMAP, SMTP, and POP3 configuration in most email clients
Most email clients maintain separate server and port settings for incoming (IMAP or POP3) and outgoing (SMTP) mail, each with its own independent security/encryption setting — confirming both are correctly configured to expect TLS/SSL and pointed at the correct port avoids a mismatch between client expectation and server configuration.
How to determine which specific mail protocol is actually generating the warning
Checking your email client's account settings for which specific server and port is associated with the warning (or testing IMAP, SMTP, and POP3 independently with OpenSSL's s_client) identifies exactly which protocol's certificate configuration needs attention, rather than assuming the entire mail server is uniformly affected.
A final note on isolating scope
If you manage a mail server receiving multiple reports of this warning, checking whether the issue is isolated to specific email clients or affects all clients uniformly helps distinguish a genuine server misconfiguration from a client-specific quirk or outdated trust store.
What specific settings screens in common email clients control this behavior
Most email clients have separate account settings screens for incoming and outgoing mail servers, each with their own security/encryption dropdown — confirming both are set to the correct option (usually SSL/TLS or STARTTLS, matching your mail server's actual configuration) resolves most client-side mail certificate warnings.
How to test your mail server's actual certificate independent of any specific client
Connecting directly with OpenSSL's s_client using the appropriate STARTTLS flag for your specific mail protocol and port shows the actual certificate being served, independent of any particular email client's own handling or display quirks.
A quick closing checklist
A quick closing checklist covers testing IMAP, SMTP, and POP3 independently with OpenSSL, confirming your email client's specific port and security settings match your mail server's actual configuration, and checking whether the warning is client-specific or reflects a genuine server-side issue.
Why mobile email apps sometimes show different behavior than desktop email clients for the same account
Mobile email apps occasionally implement their own certificate validation logic somewhat independently of the underlying mobile OS's general trust store, similar to the browser-specific trust store nuances covered elsewhere on this site — worth testing both if you're seeing inconsistent warnings across devices.