How to resolve "Could not convert socket to TLS" errors observed with email notifications for Forms

Issue

• When email notifications are enabled for Forms, emails are not being received after a form submission.
• The following error is displayed in the logs:

2021-08-02 14:10:29.458 ERROR [liferay/mail-1][MailEngine:128] Unable to send message: Could not convert socket to TLS
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
        at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
        at sun.security.validator.Validator.validate(Validator.java:260)
        at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
        at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
        at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
        at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)
        at com.sun.mail.util.SocketFetcher.configureSSLSocket(SocketFetcher.java:626)
        at com.sun.mail.util.SocketFetcher.startTLS(SocketFetcher.java:553)
        at com.sun.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:2150) 

Environment

• DXP 7.0
• DXP 7.1
• DXP 7.2

Resolution

• Workaround - If TLS is not configured properly and "Enable StartTLS" is checked in mail settings under server administration, the above error will be thrown. Unchecking "Enable StartTLS" would bypass encryption and should allow emails to be received.  
• In order for "Enable StartTLS" to work, ensure that TLS is properly configured. A common check is to verify that the mail server certificate is valid or not expired:   

1. 1. 1. Get the trust chain from the certificate provider and save the certificates on the server.
      2. Import the certificates into the java keystore * using the following command (for each certificate): 
         • • <JAVA_HOME>/keytool -import -alias <aliasname> -keystore /path/to/keystore -file /path/to/certificate
           • * default location is <JAVA_HOME>/jre/lib/security/cacerts
      3. Provide the password to the keystore

• Once TLS is properly configured, "Enable StartTLS" can be enabled again to allow encryption. 

Additional Information

• Due to concerns over security vulnerability, Liferay decided to disable TLS 1.0 for inbound connections and support TLS 1.1 and above. As such, server administrators needed to review their deployment configurations and adjust them as needed to enable a higher TLS protocol version.