Hi Jonas

The above error message you provided had pointed out the issue already. What's the domain name in your cert? does it match to your smtp host?

The host name did not match the name given in the server's SSL certificate.

Alternatively, you can try to use SmtpClient to see if it works in order to isolate the fundamental issue. 

p.s. MailKit is keeping up with the latest security best practices and continously removing outdated protocols. You can find more details and workaround from the link below if you still want to use MailKit without correct certificate.

MailKit/FAQ.md at master · jstedfast/MailKit (github.com)

I hope above helps. 

Thanks Vincent. 

I hear you. Why would it work in other site on epi11 and with curl. And this with usessl=false

The error provided is for me not consistant.

Is it Optimizely that requires a certificate? 
I am not getting same error when using Powershell.

Hi Jonas,

The problem is probably the default implementation of EPiServer.Notification.Internal.ISmtpClient. It uses SecureSocketOptions.Auto when you configure the UseSsl: false. You could implement your own ISmtpClient, but unfortunately the default implementation is internal so can't inherit that as a base.

    public class SmtpClientProvider : EPiServer.Notification.Internal.ISmtpClient
    {
        private readonly ILogger _logger;
        private readonly SmtpOptions _options;

        public SmtpClientProvider(SmtpOptions options, ILogger<SmtpClientProvider> logger)
        {
            _options = options;
            _logger = logger;
        }

        private void SaveToPickupDirectory(MimeMessage message, string pickupDirectory)
        {
            int num = 0;
            do
            {
                string path = Path.Combine(pickupDirectory, Guid.NewGuid().ToString() + ".eml");
                if (File.Exists(path))
                {
                    continue;
                }
                try
                {
                    using FileStream stream = new FileStream(path, FileMode.CreateNew);
                    message.WriteTo(stream);
                    return;
                }
                catch (IOException)
                {
                }
            }
            while (num++ < 3);

            _logger.LogError("Unable to write email to disk {PickupDirectory}", pickupDirectory);
        }

        public virtual async Task SendAsync(MimeMessage message)
        {
            if (_options.DeliveryMethod == DeliveryMethod.Network)
            {
                using SmtpClient client = new();

                await client.ConnectAsync(_options.Network.Host, _options.Network.Port.GetValueOrDefault(), (!_options.Network.UseSsl.GetValueOrDefault()) ? SecureSocketOptions.None : SecureSocketOptions.StartTls);

                if (!string.IsNullOrWhiteSpace(_options.Network.UserName))
                {
                    await client.AuthenticateAsync(_options.Network.UserName, _options.Network.Password);
                }

                await client.SendAsync(message);

                await client.DisconnectAsync(quit: true);
            }
            else
            {
                if (_options.DeliveryMethod != DeliveryMethod.SpecifiedPickupDirectory)
                {
                    throw new NotSupportedException("Unsupported DeliveryMethod");
                }
                SaveToPickupDirectory(message, _options.SpecifiedPickupDirectory?.PickupDirectoryLocation);
            }
        }
    }

You can just add that in to the services

services.AddScoped<ISmtpClient, SmtpClientProvider>();

Maybe someone from Optimizely can comment is that a bug that should be fixed or a feature

Thanks Antti. Great response and solution.

We ended up changing smtp-server/service that has support for ssl and with certificate. That would have been the best if the existing smtp server would support SSL but its an big organisation and the service could not change just like that :)