Expired MFP TLS cert breaks Scan to Email — quick renewal path
Joe B.
Reviewed for technical accuracy
Specialities: Scan to Email, SMTP/TLS with Microsoft 365 & Gmail, MFP device certificates, HP EWS, Ricoh Web Image Monitor, multi-function printer security
Expired MFP TLS certificate stops Scan to Email — renew device cert, fix SMTP TLS 1.2 errors, restore secure scanning
Technician
Quick check so I can give you an exact renewal path:
• Brand/model of the multi-function printer (HP, Ricoh, Canon, Brother, Xerox)?
• What email system are you scanning through — Microsoft 365 / Office 365 (smtp.office365.com), Gmail, or your own SMTP server?
• Exact message on the panel or in the logs: “TLS/SSL not available”, “Device certificate expired”, “Cannot connect using TLS 1.2”, or just “Authentication failed”?
• Do you already see a warning in the printer’s Embedded Web Server / Remote UI about an expired device certificate or “site certificate”?
Technician
The MFP uses a **TLS handshake** when it talks to smtp.office365.com. Part of that handshake is the printer presenting its own device certificate (self-signed or CA-signed). Once that TLS cert expires, many printers automatically:
• Turn off SSL/TLS for SMTP, or
• Still try TLS, but Exchange Online rejects the connection as insecure.
So we’ll:
1) Log in to the printer’s Embedded Web Server (EWS) and confirm the expired device certificate.
2) Generate and install a **new TLS certificate** (quick self-signed, or a proper CA certificate if you want).
3) Re-enable SMTP over TLS 1.2 and confirm the Scan to Email profile for Microsoft 365 (server, port 587, auth, encryption).
4) Send a test email and set a reminder before the next certificate expiry so this doesn’t surprise you again.
Technician
1) On a PC, open a browser and type the printer’s IP address (e.g.
http://192.168.x.x or https://192.168.x.x). That opens the HP Embedded Web Server (EWS).2) Sign in as Administrator if prompted.
3) Look for a Security → Certificates or Networking → SSL/TLS section. On Ricoh/Canon this might be under Device Certificate, Site Certificate, or Web Server Certificate.
4) Open the existing certificate details. You’ll normally see:
• Status: Expired
• Common Name (CN): printer hostname or IP
• Valid From / Valid To dates
• Selected as the default device or SSL certificate.
Tell me what it says for Status and Valid To, and if you see a button for **Create self-signed certificate** or **Generate CSR** — that decides which renewal path we use.
Technician
You’ve got two options:
• Quick fix: create a new self-signed TLS certificate on the MFP. This is enough for most small offices and will immediately re-enable Scan to Email over TLS.
• Best practice: generate a CSR (certificate signing request), get it signed by your internal or public Certificate Authority, then import the signed certificate and any intermediate CA chain. This removes browser warnings and scales better across multiple MFPs.
Since your main problem is “Expired MFP TLS certificate breaks Scan to Email”, we’ll do the quick path first so email starts working again, then I can explain how to move to a CA-signed cert later if you’d like.
Technician
1) In the certificate section, click Create self-signed certificate (or similar).
2) Use the printer’s hostname or IP as the Common Name (CN). Set the validity to at least 3–5 years so you’re not fixing this every few months.
3) Save/apply. The printer will create a new device certificate and mark it as Active/Default.
Step 3 — Re-enable SSL/TLS for SMTP (Scan to Email)
4) Go to the Scan to Email / SMTP settings page.
5) For Microsoft 365 use:
• SMTP server:
smtp.office365.com• Port: 587
• Encryption: STARTTLS / TLS (not “None”)
• Authentication: On, with a licensed mailbox or SMTP-enabled account (user@domain.com + password or app password).
6) Make sure the option like “Validate server certificate” is enabled only if the printer’s firmware supports modern **TLS 1.2** — older models sometimes struggle and need a firmware update first.
Save and run the built-in SMTP test if your HP offers one, then try a Scan to Email.
Technician
For Microsoft 365 Scan to Email on a multi-function printer you have two common options:
• Authenticated SMTP (recommended) — uses
smtp.office365.com, port 587, TLS 1.2, and a mailbox username/password.• Unauthenticated relay via connector — if your MFP doesn’t support modern TLS or SMTP AUTH is disabled.
For the authenticated route on the MFP:
1) Double-check the username is the full email address (e.g.
scanner@yourdomain.com).2) Confirm the password is correct. If you use MFA, you must generate an app password or move to an SMTP relay connector instead of basic auth.
3) Ensure encryption is set to STARTTLS or “Use TLS if available”, and not SSL on port 465.
4) If there’s a “Use legacy TLS” or “Use TLS 1.0” toggle, turn it off — Exchange Online requires TLS 1.2 now.
After those changes, try the printer’s SMTP test again and let me know if the error persists or changes.
Technician
• New MFP TLS device certificate (self-signed, not expired).
• SMTP over TLS 1.2 on port 587.
• Scan to Email profile pointing to Microsoft 365 with valid credentials.
To avoid another “Scan to Email stopped due to expired certificate” incident:
• Note the new certificate’s expiry date and drop a calendar reminder 30–60 days before it.
• If you manage multiple printers, consider using a CA-signed certificate you renew centrally, then import to each MFP (HP EWS, Ricoh Web Image Monitor, Canon Remote UI, etc.).
• Keep printer firmware updated so it supports current TLS cipher suites that Microsoft 365 and other SMTP providers require.
Technician
• Make sure the MFP’s time and date (and NTP server) are correct — clock drift can also break TLS validation and Scan to Email.
• Disable any old “SSL v3 / TLS 1.0” toggles if the firmware lets you, so it prefers TLS 1.2 only.
• If available, restrict Scan to Email to authenticated users or specific domains so the printer can’t be abused as an open relay.
If you ever decide to move from a self-signed to a CA-signed certificate for cleaner HTTPS access (no browser warnings), we can walk through the CSR, import, and binding steps too.
Technician
• Creating a fresh device certificate (self-signed or CA-signed) in the MFP’s web interface.
• Re-enabling SSL/TLS for SMTP and pointing to the correct server (e.g.
smtp.office365.com, port 587, TLS 1.2).• Updating the Scan to Email profile with valid credentials and testing from the panel.
• Setting a reminder before the cert expires again.
If you’d like, I can step through the exact menus for your model (HP, Ricoh, Canon, Brother, Xerox) and your mail provider. Just open the chat and mention “expired TLS cert — Scan to Email”.
Quick answer: the accepted fix
Accepted fix when an expired MFP TLS certificate breaks Scan to Email: log into the printer’s web interface, create or import a new device certificate, set it as the active SSL/TLS cert, then re-enable SMTP over TLS 1.2 (e.g. smtp.office365.com, port 587, STARTTLS) in the Scan to Email/SMTP profile. Test from the panel and set a reminder before the next certificate expiry.
Why an expired TLS certificate stops Scan to Email on MFPs
Modern mail providers like Microsoft 365 and Google Workspace require secure SMTP connections using TLS 1.2. When the multi-function printer starts a TLS handshake, it may present its own device certificate. If that certificate is expired, has the wrong hostname, or uses weak crypto, the printer or mail server can refuse the connection. The result is that Scan to Email fails with generic “TLS/SSL not available”, “certificate expired”, or “authentication failed” errors even though the username and password are correct.
Renewing the MFP TLS certificate, enabling SSL/TLS on the device, and matching the correct SMTP encryption settings (server name, port 587, STARTTLS, authentication) restores secure Scan to Email without disabling security checks or falling back to unencrypted SMTP.
How to verify your MFP TLS renewal actually fixed Scan to Email
After installing the new device certificate, open the printer’s security or certificate page and confirm the status is Valid with a future expiry date. Then run the built-in SMTP test from the Scan to Email or Email Setup screen. You should see “Test email sent” instead of TLS or authentication errors.
If Scan to Email still fails, check that the SMTP profile uses the correct encryption type (TLS/STARTTLS), port, and credentials for your provider. For Office 365 that typically means smtp.office365.com, port 587, TLS 1.2, and an authenticated mailbox. On some Ricoh, Canon, or Xerox devices you might also need a firmware update so the MFP supports the same cipher suites that your mail provider now enforces.
Expired TLS cert — quick Scan to Email recovery tips
Most Scan to Email outages on MFPs come down to an expired device certificate, outdated TLS settings, or stricter SMTP requirements from your mail provider.
Quick path: open the printer’s Embedded Web Server / Remote UI → create or import a new TLS device certificate → enable SSL/TLS for SMTP → set the correct SMTP server, port, and authentication for Microsoft 365, Gmail, or your email host → run a test scan. This resolves the majority of “Scan to Email not working after TLS changes” cases without weakening security.
Disclaimer: This information is AI-generated and intended for general guidance only. For advice specific to your environment, please consult a verified expert on Whizz-Tech before making decisions.
Getting Started Is Easy
Ask for help, 24/7
Members enjoy round-the-clock access to 12,000+ verified Experts, including tech support, mechanics, vets, and more.
Expert will respond in minutes
We match you with an Expert who specializes in your situation. Talk, text, or chat — whichever you prefer.
Save time & money
No scheduling hassles or expensive consults. Membership can save you significant time and money each month.
FAQ
How does an expired MFP TLS certificate break Scan to Email?
When the device certificate on your MFP expires, the printer may disable SSL/TLS or fail the TLS handshake with your SMTP server. Providers like Microsoft 365 require valid TLS 1.2, so the connection is rejected and Scan to Email stops working until you renew and activate a new certificate.
Should I use a self-signed or CA-signed certificate on my printer?
A self-signed device certificate is usually enough to restore Scan to Email quickly and is common in small offices. A CA-signed certificate is better for larger or regulated environments because browsers trust it, and you can manage expiry centrally. Both options work as long as the printer supports modern TLS and the certificate is valid.
What SMTP/TLS settings does Microsoft 365 require for Scan to Email?
For authenticated Scan to Email, use smtp.office365.com, port 587, STARTTLS enabled, and a mailbox with SMTP AUTH allowed. The printer must support TLS 1.2. Make sure you’re not using legacy SSL on port 465 or old TLS versions that Exchange Online no longer accepts.
How can I avoid Scan to Email outages from certificate expiry?
After you renew the MFP TLS certificate, note the expiry date and set calendar reminders 30–60 days before it. If possible, standardize on a CA-signed certificate deployed to all devices and keep printer firmware updated so it continues to meet your email provider’s TLS requirements.
Sources
- HP Support — Set up and use the Scan to Email feature
- Microsoft Learn — Set up a multifunction device to send email using Microsoft 365
- Ricoh — Enabling SSL/TLS and device certificates on MFPs
Filed under: Printers
Related articles
- Printer says “Offline” and won’t print — what should I check first?
- My printer “forgot” my Wi-Fi — the saved network is gone
- Printer Wi-Fi settings reset by itself — why did it forget my network?
- My printer keeps popping up “Set up Wi-Fi” again — why won’t it stay connected?
- Why does my printer need Wi-Fi setup again? It was working yesterday.
- My printer Wi-Fi setup keeps failing — what am I doing wrong?
- Printer Wi-Fi setup is confusing — why won’t it connect to my network?
- Printer Wi-Fi setup is too complicated — what do I check first without messing it up?