Add Let's Encrypt Certificates To Older Devices¶

Use this page when an older computer, phone, or mail client does not trust a Fused SSL certificate. This most often appears as a certificate warning in older software such as Outlook 2007.

Fused SSL certificates are normally issued through Let's Encrypt. Modern operating systems already trust the Let's Encrypt roots. Older systems may not, especially if Windows root certificate updates have not been installed.

What Is Failing¶

SSL trust works like an ID check. The mail server presents a certificate, and the computer checks whether that certificate chains back to a trusted root authority.

If the device does not trust the root certificate, Outlook may show errors such as:

• The server's security certificate cannot be verified.
• The target principal name is incorrect.
• The certificate chain was issued by an authority that is not trusted.
• The server uses a security certificate that cannot be verified.

For Let's Encrypt certificates, the root usually involved is ISRG Root X1. Let's Encrypt lists its current and historical roots and intermediates on its Chains of Trust page.

Before Installing A Certificate¶

Check these first:

1. Confirm the mail server hostname is correct.
2. Confirm the computer's date and time are correct.
3. Install available Windows updates.
4. Restart Outlook and test again.

If the hostname is wrong, installing certificates will not fix the problem. For example, the mail app should use the hostname shown in the Fused email settings, not a random server name from an old setup.

Find email settings

Install ISRG Root X1 On Windows¶

Use these steps only on a device that must keep using the older mail client.

1. Open the Let's Encrypt Chains of Trust page.
2. Find ISRG Root X1 under Root CAs.
3. Download the pem or der certificate for the self-signed ISRG Root X1 certificate.
4. Save the file somewhere easy to find.
5. Open the certificate file.
6. Select Install Certificate.
7. Choose Local Machine if Windows offers that option. Administrator approval may be required.
8. Select Place all certificates in the following store.
9. Choose Trusted Root Certification Authorities.
10. Finish the import.
11. Restart Outlook.
12. Test sending and receiving mail again.

If Outlook 2007 Still Fails¶

If the warning continues after installing the root certificate, the issue may not be the root certificate.

Check:

• The incoming and outgoing hostnames match the Fused settings.
• The account uses the full email address as the username.
• SMTP authentication is enabled.
• The selected ports and SSL/TLS settings match the mail app.
• Windows supports the TLS version required by the mail server.

Outlook 2007 on very old Windows versions may not support the TLS behavior required by modern mail servers. In that case, the practical fix is to use a current mail client or a supported operating system.

Safer Options¶

For long-term use, prefer:

• Current Outlook through Microsoft 365.
• Thunderbird.
• Apple Mail on a supported macOS version.
• The built-in mail app on a supported iPhone, iPad, Android, or Windows device.
• Webmail from a modern browser.

Related Guides¶