We don't enable authentification with user/pwd on our local smtp configuration:

[smtp_options]
enable_password_reset=true
server="smtp.XXXX"
port=465
smtp_encryption = "TLS"
#user="XXX"
#password="XXX"
from="XXXX"
reply_to="XXXX"

Error :

2025-01-09T10:36:07.397297171+00:00  DEBUG    │  ┝━ :bug:ion, source: Custom { kind: InvalidData, error: InvalidCertificate(UnknownIssuer) } } }
2025-01-09T10:36:10.399530183+00:00  WARN     │  ┝━ :construction:
2025-01-09T10:36:10.399539220+00:00  INFO     │  ┕━ ｉ [info]: Reset token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2025-01-09T10:36:10.399597878+00:00  DEBUG    ┕━ :bug:

It seems that is due to an invalid SMTP certificate. Make sure the certificate is signed by a recognized CA, and that it applies for the domain of the mailer

we have our own CA (auto signed) and the certificate sent by smtp server is signed with that CA, lldap requires a recognized CA ?

The underlying library is lettre, I don't know how to pass it specific CAs, but we don't pass it custom ones, no

@nitnelave Now if I try to bypass TLS with this configuration :

[smtp_options]
enable_password_reset=true
server="smtp.XXXX"
port=25
smtp_encryption="NONE"
user=""
password=""
from="XXXX"
reply_to="XXXX"

I have this error :

2025-01-09T12:47:25.721236908+00:00  DEBUG    │  ┝━ 🐛 [debug]: Error sending email: lettre::transport::smtp::Error { kind: Permanent(Code { severity: PermanentNegativeCompletion, category: Unspecified3, detail: Zero }), source: "5.7.0 Must issue a STARTTLS command first" }
2025-01-09T12:47:28.722854893+00:00  WARN     │  ┝━ 🚧 [warn]: Error sending email: "Error sending email: permanent error (530): 5.7.0 Must issue a STARTTLS command first"

That's from your server, it's not expecting unencrypted traffic

I change this configuration on smtp server and it works :

smtpd_tls_security_level=encrypt => smtpd_tls_security_level=may