Understanding the Root Cause
The error occurs during the Transport Layer Security (TLS) handshake between your WordPress instance and Microsoft’s mail servers. When WPMail attempts to connect to smtp.office365.com on port 587, it verifies the server's SSL/TLS certificate against a list of trusted Certificate Authorities (CAs) stored on your hosting server. If this list is outdated, missing, or if the verification process is too strict for your specific hosting configuration, the connection is aborted.
This is not necessarily a problem with your Office 365 credentials. Instead, it is a discrepancy between the security expectations of the PHP mail library used by WPMail and the actual state of your server’s certificate store. Many shared hosting environments run older versions of OpenSSL or PHP that do not include the latest root certificates required by modern cloud email providers like Microsoft.
Verifying Server Certificate Availability
Before changing plugin settings, you must determine if your server can actually verify the certificate. This diagnostic step helps you decide whether to fix the server side or relax the client side. Log in to your hosting control panel or access your server via SSH if you have command-line access. You need to check if the ca-certificates package is installed and up to date.
If you have shell access, run the following command to update your certificate bundle:
sudo update-ca-certificatesIf you are on a managed WordPress host without SSH access, contact your support team and ask them to ensure that the system-wide CA certificates are current. Often, simply restarting the web server after an update can resolve temporary caching issues with certificate paths. If the server cannot verify the certificate natively, you will need to adjust the WPMail configuration to handle this limitation gracefully.
Adjusting WPMail Plugin Settings
The most common and effective fix for this issue within the WordPress ecosystem is to disable strict SSL verification within the WPMail plugin settings. This does not mean your emails become insecure; it means the plugin stops checking the certificate chain against the local CA bundle, allowing the connection to proceed based on other security factors. This is a standard workaround for environments where certificate updates are delayed or restricted.
- Navigate to your WordPress Dashboard.
- Go to Settings and select WPMail.
- Look for the section labeled SMTP Configuration or Advanced Settings.
- Find the option named SSL Verification, Verify Peer, or TLS Verify.
- Uncheck this box or set the value to
false. - Save your changes.
After making this change, send a test email. The TLS handshake should now complete successfully, bypassing the certificate verification error. Note that while this resolves the immediate error, you should still ensure that your connection uses encryption (STARTTLS) which is the default for Office 365 on port 587.
Updating PHP OpenSSL Libraries
If disabling verification is not acceptable for your security policy, you must update the underlying PHP libraries. This requires administrative access to your server. Outdated versions of OpenSSL may not recognize newer root certificates issued by Microsoft. Check your current PHP version and OpenSSL version by creating a simple phpinfo() page or running php -v in the terminal.
On Debian or Ubuntu-based systems, you can update these libraries using:
sudo apt-get update
sudo apt-get install openssl ca-certificates libssl-devOn CentOS or RHEL systems, use:
sudo yum update openssl ca-certificatesAfter updating, restart your PHP-FPM service or Apache/Nginx web server to load the new libraries. This approach is more robust than tweaking plugin settings because it fixes the problem at the system level, ensuring all applications on the server benefit from updated security standards. However, this is only possible if you control the server environment.
Configuring SMTP Host and Port Correctly
Ensure that your WPMail settings match Microsoft’s exact requirements. Incorrect ports or hostnames can sometimes trigger verification errors indirectly. For Office 365, the correct settings are:
- SMTP Host:
smtp.office365.com - SMTP Port:
587(for STARTTLS) - Encryption:
TLSorSTARTTLS - Authentication: Enabled with valid Office 365 credentials
Using port 465 with SSL is deprecated for Office 365 and may cause confusion. Stick to port 587 with STARTTLS. If you are using a custom domain or relay, ensure that the DNS records are correctly configured to allow your server IP to send mail. Misconfigured SPF or DKIM records do not cause TLS errors directly, but they indicate broader email infrastructure issues that should be addressed alongside the certificate problem.
Frequently Asked Questions
Is it safe to disable SSL verification in WPMail?
Disabling peer verification allows the connection to proceed without checking the CA bundle, but it does not disable encryption itself. Your data is still encrypted in transit using TLS/STARTTLS. However, it makes the connection slightly less secure against man-in-the-middle attacks because the identity of the server is not strictly validated by your local certificates.
Why does this error happen only sometimes?
This intermittent behavior often occurs when the server’s certificate cache is stale or when there are network routing issues between your host and Microsoft’s edge servers. It can also happen if your hosting provider recently updated their OpenSSL version but hasn’t restarted the web services yet, leaving some processes with old certificate paths.
Can I use a different plugin instead of WPMail?
Yes, plugins like WP Mail SMTP or Post SMTP offer similar configuration options. If WPMail continues to fail despite proper configuration, switching to another plugin might help because they use different underlying libraries for handling SMTP connections. Some plugins have better defaults for handling certificate verification in complex hosting environments.
How do I know if my server’s certificates are outdated?
You can check the expiration date of your local CA certificates by inspecting the /etc/ssl/certs/ca-certificates.crt file or using commands like openssl x509 -in /etc/ssl/certs/ca-certificates.crt -noout -dates. If the dates are several years old, your server likely needs an update to recognize newer certificates issued by major providers like Microsoft.
Does this error affect received emails?
No, this error only affects outgoing emails sent via SMTP. Receiving emails is handled by IMAP or POP3 protocols, which are separate from the SMTP sending process. If you are experiencing issues with receiving mail, you would need to troubleshoot your inbox configuration separately.