Nodemailer “self-signed certificate in certificate chain” and “unable to verify the first certificate”

Which setup gives which message

On 16.10.2026 we ran local SMTP servers with certificates made by openssl and connected Node.js 22.23 and nodemailer 10.1.1 to each. Every failure had code: "ESOCKET" and command: "CONN"; only the message changed:

The STARTTLS case on port 587 gave the same self-signed certificate message as port 465. The last row we reproduced with Node's TLS client against one of Gmail's IP addresses: the certificate was valid, just not for a bare IP.

Where an unknown root comes from

• Antivirus or a company proxy. Some security tools scan mail by decrypting it and re-signing it with their own root. Your browser trusts that root because the tool installed it in the system; Node uses its own list and does not. That is why the error can appear on one machine and not on another.
• A private mail server with a self-made certificate, common on internal Exchange or Postfix boxes.
• A local test server such as MailHog or a Docker mail container.
• The host name in your config is an IP or an internal alias that the certificate does not list.

Trust the root instead of turning checks off

Get the root certificate from whoever runs the proxy or server, as a PEM file. Give it to one transport with tls.ca, or to the whole process with NODE_EXTRA_CA_CERTS. Both fixes worked on our test; the connection that failed with “self-signed certificate in certificate chain” then sent.

tls: { rejectUnauthorized: false } also made every case send. It is fine on a test server on your own laptop. On a real server it means anyone between you and the mail server can read the SMTP password. For the IP case, use the host name the certificate was issued for, or set tls.servername to it.

import fs from "node:fs";

// Trust one extra root certificate for this transport only
const transporter = nodemailer.createTransport({
  host: "mail.yourcompany.local",
  port: 465,
  secure: true,
  tls: { ca: [fs.readFileSync("./company-root-ca.pem")] },
  auth,
});

// Or for the whole Node process, without code changes:
// NODE_EXTRA_CA_CERTS=./company-root-ca.pem node server.js

Do you need an SMTP connection for a contact form?

If the SMTP login exists only so a contact form can email you, you can drop it: a form that posts to Formgong at https://formgong.com/submit has no SMTP host, port or password in your code, and Formgong sends the notification itself. See the HTML guide.