case 4724 - SMTP certificate checked, password never returned

Mailer checks the SMTP server's certificate (trust and name; no revocation
check). New config setting AYANOVA_SMTP_ACCEPT_ANY_CERTIFICATE accepts any
certificate (boot warning, shown in server info, manual page).
The notification settings GET returns ******** instead of the SMTP
password; a PUT with ******** or empty keeps the stored password.
F30 and F31 fixed. Changelog and manual updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/8.0/ayanova/docs/changelog.md

@@ -26,6 +26,8 @@ IN PROGRESS
 - Server: the automatic internal backup now runs the database backup utility directly instead of through a command shell, so the database password can contain any characters, and a failed backup is now reported as an error instead of appearing to succeed. See [backup](ops-form-backup.md).
 - Server: log files are now named with an increasing number when they are archived; the [server log](ops-log.md) form lists them newest first.
 - Server: removed an unused internal performance profiling component.
+- Server: AyaNova now checks the email (SMTP) server's security certificate when sending email. If your mail server uses a self-signed or internal certificate and email notifications stop after upgrading, see [SMTP certificate check](ops-config-smtp-accept-any-certificate.md).
+- Server: the SMTP server password is no longer shown in the [notification settings](ops-notification-system.md) form; it shows `********` when a password is set. Type a new password to change it.
 - Linux: Ubuntu 24.04 and 26.04 are now tested and supported. On Ubuntu 24.04 and newer the .NET runtime is installed from Ubuntu's own package archive.
 - Docs: updated the [Linux server](ops-install-linux-server.md), [Linux desktop](ops-install-linux-desktop.md), [Windows local network](ops-install-windows-lan.md) and [Windows IIS](ops-install-windows-iis.md) installation and upgrade instructions for .NET 10 and Ubuntu 24.04 / 26.04.
 - Docs: updated the database password guidance in the installation and [backup](ops-form-backup.md) documentation.

docs/8.0/ayanova/docs/ops-config-environment-variables.md

@@ -95,6 +95,10 @@ Command line parameters are appended to the command to start the ayanova server,
 - [AYANOVA_REPORT_RENDERING_TIMEOUT](ops-config-report-rendering-timeout.md)
 - [AYANOVA_REPORT_RENDER_API_URL_OVERRIDE](ops-config-report-rendering-api-url-override.md)
 
+### EMAIL
+
+- [AYANOVA_SMTP_ACCEPT_ANY_CERTIFICATE](ops-config-smtp-accept-any-certificate.md)
+
 ### SECURITY
 
 - [AYANOVA_SET_SUPERUSER_PW](ops-config-set-superuser-pw.md)

docs/8.0/ayanova/docs/ops-config-smtp-accept-any-certificate.md

@@ -0,0 +1,53 @@
+# SMTP certificate check setting
+
+When AyaNova connects to the SMTP server set in the [notification settings](ops-notification-system.md) to send email, it checks the mail server's security certificate. The certificate must be issued by a trusted certificate authority and must match the SMTP server address entered in the notification settings. This prevents someone on the network from posing as your mail server to collect the SMTP account password and the messages being sent.
+
+Most mail servers and email providers have a certificate that passes this check and nothing needs to be done.
+
+## When the check fails
+
+If the mail server's certificate can not be validated, email notifications are not sent. The Send test message option in the notification settings shows an error such as "The server's SSL certificate could not be validated", and failed deliveries are reported in the [notification system](ops-notification-system.md) as usual.
+
+This can happen when:
+
+- the mail server uses a self-signed certificate or one issued by your organization's own internal certificate authority
+- the SMTP server address is entered as an IP address or a name that the certificate does not cover
+
+The best fix is to correct the cause: enter the SMTP server address exactly as named in its certificate, or install your internal certificate authority as trusted on the computer running the AyaNova server. If neither is possible, the check can be switched off with this setting.
+
+## Default
+
+If this setting is not specified the certificate is checked.
+
+## Overriding
+
+AyaNova expects this value to be provided by a config.json property, environment variable or command line parameter named
+
+`AYANOVA_SMTP_ACCEPT_ANY_CERTIFICATE`
+
+Set it to `true` to accept any certificate from the mail server. Only do this for a mail server on a network you trust: without the check, the connection to the mail server is encrypted but AyaNova can not tell if it is talking to your real mail server.
+
+When it is set, the AyaNova server log records a warning each time the server starts.
+
+Example config.json entry
+
+```json
+{
+  ...other properties...
+  "AYANOVA_SMTP_ACCEPT_ANY_CERTIFICATE": "true"
+}
+```
+
+Example command line parameter
+
+`ayanova.exe --AYANOVA_SMTP_ACCEPT_ANY_CERTIFICATE="true"`
+
+Example environment variable
+
+Windows
+
+`set "AYANOVA_SMTP_ACCEPT_ANY_CERTIFICATE=true"`
+
+Linux
+
+`export AYANOVA_SMTP_ACCEPT_ANY_CERTIFICATE="true"`

docs/8.0/ayanova/docs/ops-notification-system.md

@@ -46,7 +46,7 @@ Typically this is an email address, for example `noreply@example.com` but some m
 
 #### SMTP server password
 
-The password the SMTP server requires to send email using the SMTP server account address. Note that this password is visible in this form to system operators and the read only roles listed above.
+The password the SMTP server requires to send email using the SMTP server account address. Once saved, the password is never shown in this form: it shows `********` when a password is set. To change it, type the new password and save. Leaving `********` in place keeps the saved password.
 
 We recommend a dedicated email account used only for sending notifications.
 
@@ -60,6 +60,8 @@ The choices are:
 - SSL \ TLS recommended and most secure. Implicit forced security.
 - StartTLS not recommended, negotiated security, may or may not be secure depending on the capabilities of the mail server.
 
+AyaNova checks the mail server's security certificate when it connects. See [SMTP certificate check](ops-config-smtp-accept-any-certificate.md) if the test message reports that the certificate could not be validated.
+
 #### SMTP server port
 
 This is the port that must match the SMTP server's mail port. Most modern mail servers use port `587` which is the current recommended standard port for encrypted mail transmission.

docs/8.0/ayanova/mkdocs.yml

@@ -197,6 +197,7 @@ nav:
           - "Reporting render browser path": "ops-config-report-render-browser-path.md"
           - "Reporting timeout configuration": "ops-config-report-rendering-timeout.md"
           - "Environment variable reference": "ops-config-environment-variables.md"
+          - "SMTP certificate check": "ops-config-smtp-accept-any-certificate.md"
           - "Security and JWT web tokens": "ops-config-jwt-secret.md"
           - "SuperUser password reset": "ops-config-set-superuser-pw.md"
           - "Server error codes": "ops-error-codes.md"