Certificate issues on mail clients

dbuerer

New cluster of two servers, server 1 is web/dns/database/control panel; sever 2 is dns/email. Got all my clients moved and transitioned ok.

Made nameserver change at 3pm yesterday (it's 10:30am now) and things started moving . Web/DNS/DB no problems. Email, works great from roundcube and is receive new messages. Minor hiccough in that i forgot to put MX records in the DNS template so i had to goback and add them all manually this morning (uggh +1 for bulk change DNS)

Now, when an email attemps to connect to retrieve email, like Outlook or Android, i get an untrusted/invalid cert message. I eamined the cert from outlook at the cert it's pulling is i think the self-signed cert from my VPS provider. HOWEVER, when i use openssl to manually pull the cert from the mail server, it reads correctly.

Anyone have an idea what might be going on and how to fix?

This is the command i pull to manually check:
openssl s_client -showcerts -connect mail.buerer.net:465 -servername mail.buerer.netopenssl s_client -showcerts -connect mail.buerer.net:465 -servername mail.buerer.net

The issue that was outlook shows was issued to VM-5b9d2840-8cb4-4a38-xxxxxx valid from 3/5/26->3/2/2036 (guessing the self signed cert)

dbuerer

I posted too soon....i just found the problem but don't know how to fix it. One of my domains, buerer.net, has a cert a mail.buerer.net which is appropriate. However, mail clients are pointing to imap.buerer.net. There is no cert for imap.buerer.net even though there is a DNS entry for it. I was using imap at my previous host because it worked well with some client auto-configs albeit i dont' know which ones.