> Source: [sk108287](https://support.checkpoint.com/results/sk/sk108287)
# sk108287 - When configuring the mail settings in SmartEndpoint and pressing "Send test email", it completes with a failure, or test email does not arrive at the client
| Property | Value |
|----------|-------|
| Solution ID | sk108287 |
| Date Created | 2015-11-02 |
| Last Modified | 2019-02-21 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X, R82.20, R82.10, R82, R81.20 |
## Symptoms
- * When configuring the mail settings in SmartEndpoint and pressing "Send test email", it completes with a failure, or test email doesn't arrive at the client.
* Error: "Could not convert socket to TLS".
* Error: "550 5.7.1 Unable to relay".
* Error: "535 5.7.3 Authentication unsuccessful"
* Message: "Email sent successfully. Check your email account.", however email does not arrive at the recipient.
## Solution
Error details: "Could not convert socket to TLS"
------------------------------------------------
**Possible cause:** email server presents a certificate for authentication. However, the certificate cannot be validated since it is not present on the Endpoint Management Server.
**Solution:** Import certificate from the mail server to the Endpoint Management Server. Proceed as follows to perform it for Microsoft Exchange Server:
***Step 1 - Find index of SSL certificate***
1. On Exchange server that is configured to support SMTP over SSL/TLS, run: *CertUtil -store -v MY*
Output of this command is list of certificates, separated by a row, as shown below "*==Certificate 0==*", where "0" is index of certificates.
2. You can redirect output of this command to a file (e.g. *CertUtil -store -v MY \> C:\\certificates.txt* )
Find certificate with subject/issuer that indicates it is the mail server (in the example below subject is CDS-EXCH2010.mulberry.com)
Get certificate's index - this is number which appears in separation header before each certificate (in the following fragment it is *== Certificate 0 ==* ).
**See the following fragment of output, significant details are in bold:**
`================ Certificate 0 ================`
`X509 Certificate:`
`Version: 3`
`Serial Number: 1b9b02cb00000000000c`
`Signature Algorithm:`
`Algorithm ObjectId: 1.2.840.113549.1.1.5 sha1RSA`
`Algorithm Parameters:`
`05 00`
`Issuer:`
**CN=CDS-EXCH2010**
`NotBefore: 19/07/2012 15:45`
`NotAfter: 19/07/2013 15:55`
`Subject:`
**CN=CDS-EXCH2010.mulberry.com**
`.....`
***Step 2 - Save the certificate to a file***
To obtain certificate, run the following command from the command line:
*CertUtil -store MY \ \*
**For example:**
*CertUtil -store MY 0 C:\\ServerCert.cer*
Important: In case the Exchange Server uses self-signed certificate, you should export it via IIS Manager using the "Export Certificate" dialog box. Find more details in the following article:
***Step 3 - Import certificate to Endpoint Security Management Server keystore***
1. Copy the certificate file to the Endpoint Security Server.
2. Open command line window.
3. **For Windows:**
1. Go to *%UEPMDIR%\\engine\\jre*directory
2. Run the following command:
*.\\bin\\keytool -import -keystore .\\lib\\security\\cacerts -file \ -alias \*
**For Example:**
*.\\bin\\keytool -import -keystore .\\lib\\security\\cacerts -file C:\\ServerCert.cer -alias SSLCert*
4. **For Gaia:**
1. Go to *$UEPMDIR/engine/jre* directory (on R80.20 the directory should be $CPDIR/jre_64)
2. Run the following command:
*./bin/keytool -import -keystore ./lib/security/cacerts -file \ -alias \*
For Example:
*./bin/keytool -import -keystore ./lib/security/cacerts -file /home/admin/ServerCert.cer -alias SSLCert*
5. You will be prompted to enter a password, the default password is "changeit".
6. At the end of import, you will be asked "Trust this certificate?\[no\]". Enter "y" to complete the process.
7. Output should be "Certificate was added to the keystore"
8. Restart the service by running *uepm_stop* and then *uepm_start*
Error details: "550 5.7.1 Unable to relay"
------------------------------------------
**Possible cause:** Exchange Server Configuration - the setup includes a mail relay (for example delivery to external mail servers is going through another server) and relay fails for the Endpoint Management Server.
**Solution:** Follow Microsoft procedure to change configuration in the Exchange Manager to allow relaying for mails sent from the Endpoint Management Server.
Error details: "535 5.7.3 Authentication unsuccessful"
------------------------------------------------------
**Possible cause:** *Exchange Server Configuration* - the user used to send emails from the Endpoint Security Management does not have sufficient permissions.
**Solution:** Re-check the authentication settings, mail delivery restrictions and security permissions defined for the user that is used to send the email.
Message says "Email sent successfully. Check your email account.", however email doesn't arrive at the recipient.
-----------------------------------------------------------------------------------------------------------------
**Possible cause:** *Exchange Server Configuration* - the user defined as sender in SmartEndpoint does not have permissions to send to external domains.
**Solution:** Fix the configuration that blocks the email.
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content