EXM Could not establish trust relationship for the SSL/TLS Secure channel

Question

I've seen an SSL/TLS error a couple of times which causes EXM to fail to send emails (some still work, but not all). It's kind of weird because it happens pretty infrequently and it goes away if you restart the server (not an iisreset, a full machine reboot), both of which seem very odd for an SSL problem.

This previously only happened on our Staging site, which did have a valid cert and could be hit with https. Earlier this week they changed the certs on our Prod site and now I've seen the problem for the first time there. As far as I know the only difference in the cert is that the ProdCD is now using an EV SSL cert instead of a wildcard cert. I'm not sure that this is the cause of the problem, but it seems worth mentioning.

We're using a Custom SMTP, Sendgrid, with the following settings. I've tried with StartTls set to both true and false, doesn't seem to matter.

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
  <sitecore>
    <exm>
      <eds>
        <smtpSettings type="Sitecore.EDS.Core.Net.Smtp.SmtpSettings, Sitecore.EDS.Core" singleInstance="true">
          <server>smtp.sendgrid.net</server>
          <port>PORT</port>
          <userName>USERNAME</userName>
          <password>PASSWORD</password>
          <authenticationMethod>LOGIN</authenticationMethod>
          <startTls>true</startTls>
          <proxySettings ref="exm/eds/proxySettings" />
        </smtpSettings>
      </eds>
    </exm>
  </sitecore>
</configuration>

Here's the log from one of the times it happened on Stage, but on the new Prod site the error is the same:

Exception: System.Security.Authentication.AuthenticationException
Message: The remote certificate is invalid according to the validation procedure.
Source: System
   at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
   at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)
   at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)
   at System.Net.ConnectStream.WriteHeaders(Boolean async)


MessageTaskRunner worker thread 18 19:13:07 ERROR Exception: Sitecore.Modules.EmailCampaign.Exceptions.NonCriticalException
Message: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.
Source: Sitecore.EmailCampaign
   at Sitecore.Modules.EmailCampaign.Core.WebContent.DownloadString(String url, Boolean useIisCredentials, String userAgent)
   at Sitecore.Modules.EmailCampaign.Messages.WebPageMail.GetMessageBody(Boolean preview)
   at Sitecore.Modules.EmailCampaign.Core.Dispatch.DispatchTask.GenerateEmailContent(Recipient recipient, String emailAddress, Language language, Guid recipientId, Dictionary`2 customPersonTokens, DateTime& startGetPageTime, DateTime& endGetPageTime, DateTime& startCollectFilesTime, DateTime& endCollectFilesTime)
   at Sitecore.Modules.EmailCampaign.Core.Dispatch.DispatchTask.OnSendToNextRecipient()

MessageTaskRunner worker thread 18 19:13:07 ERROR Failed to send 'stage-internal-warranty-4_19_17' to 'xdb:d2292776-70e3-42a0-9f01-8dac692fa911'.
ManagedPoolThread #3 19:13:07 INFO  Dispatch Message (stage-internal-warranty-4_19_17): Finished
  Result:          FINISHED
  Message Id:      {9B40A687-9F0A-4AAC-9C4A-2F817145BB7A}
  Message Path:    /sitecore/content/Email Campaign/Messages/2017/04/17T153429/stage-internal-warranty-4_19_17
  Recipients Processed:    0
  Message Total Sent Recipients:    0
  Message Total Failed Recipients:  0
  Included Recipient Lists: 
  Excluded Recipient Lists: 

Answer 1

The error in your logs is related to generating the HTML content of your email message. EXM makes a web request internally. See this if you need to force the RendererUrl to be consistent, and perhaps with HTTP instead of HTTPS, etc. https://kb.sitecore.net/articles/837879