Xerox 016-749 — fix SMTPS “certificate chain invalid” for scan to email

Joe B.

Reviewed for technical accuracy

Specialities: Xerox AltaLink/VersaLink, SMTPS, Microsoft 365, TLS certificates, Scan to Email

Resolve Xerox 016-749 — SMTPS certificate chain invalid, untrusted CA, TLS mismatch on scan to email

Technician

Hey! Let’s sort out your Xerox 016-749 error where SMTPS reports “certificate chain invalid” for scan to email.
To target the fix, I need a quick picture: which Xerox model (AltaLink, VersaLink, WorkCentre, B/C series)? Are you sending via Microsoft 365 / Exchange Online, Gmail, or your own SMTP server? And on the device, is SMTPS / SSL/TLS enabled with “Require trusted certificate” or “Validate server certificate” turned on?

Customer

It’s a Xerox AltaLink on Microsoft 365. Scan to email stopped and shows 016-749 with “certificate chain invalid” when using SMTPS. It worked before. “Require trusted certificate” is enabled.

Technician

Perfect context.
Xerox fault code 016-749 (SMTPS certificate chain invalid) usually means the device does not trust the full server certificate chain presented by your SMTP host. Common causes:
• The intermediate CA is missing on the Xerox.
• The SMTP server switched to a new TLS certificate or hostname (e.g. Microsoft 365 changes) and the chain no longer matches what the MFP trusts.
• “Require trusted certificate” / “Validate server certificate” is enabled, but only a partial or self-signed root is installed.
• Wrong SMTPS port / encryption combo (465 SSL/TLS vs 587 STARTTLS) causing a failed TLS handshake the device reports as 016-749.
Plan: 1) Confirm correct SMTP/TLS settings. 2) Import the proper root and intermediate CA so the certificate path validates. 3) Adjust the “require trusted” flag safely — not just disable security and hope.

Customer

That sounds right, we use smtp.office365.com on port 587 with STARTTLS. We didn’t touch the Xerox, but Microsoft might have rotated certs. How do I check what the printer doesn’t like?

Technician

Step 1 — Confirm Xerox SMTP / SMTPS basics
On the Xerox Embedded Web Server (EWS), as admin:
1) Go to Properties → Apps → Email → Setup (or similar, depends on model).
2) Check:
  • SMTP server / hostname: smtp.office365.com (or your provider’s exact FQDN).
  • Port: 587 for STARTTLS or 465 for implicit SSL/TLS, matching what your provider requires.
  • Connection Encryption: set to STARTTLS for 587 or SSL/TLS for 465 — no mixing.
  • Authentication: valid Microsoft 365 / SMTP credentials, modern password, no expired account.
3) If any value is wrong, correct it and test again. If 016-749 still reports “certificate chain invalid”, we know the CA trust on the Xerox needs updating — that’s where we fix the real issue.

Customer

Settings match: smtp.office365.com, port 587, STARTTLS, auth OK. Still getting 016-749 certificate error. How do we import the right certificates to Xerox?

Technician

Step 2 — Fix “certificate chain invalid” with trusted CAs
1) From a PC, run an SMTP TLS test, for example:
  openssl s_client -starttls smtp -connect smtp.office365.com:587 -showcerts
  This shows the full certificate chain your Xerox must trust (leaf, intermediates, root).
2) Download the corresponding root and intermediate CA certificates from the official authority (e.g. DigiCert / Microsoft, never from random sites).
3) On the Xerox EWS, go to Properties → Security → Certificates → Trusted Certificates (name may vary) and import those CA files in PEM/DER format.
4) Make sure they’re marked as Trusted for SSL/TLS or “Certificate Authority”.
Once the correct CA chain is installed, the device can validate the SMTPS server and the 016-749 certificate chain invalid fault should clear on the next test.

Customer

We had an old internal SMTP relay before. Could leftover certs or wrong hostname also trigger 016-749?

Technician

Absolutely, and it’s a common trap.
• The SMTP server name you enter on the Xerox must match the name on the certificate. If the cert is for mail.company.com but the device points to the bare IP, the certificate chain validation fails and you’ll see 016-749 / SMTPS errors.
• If you changed from on-prem relay to Microsoft 365, remove obsolete settings: old gateway, outdated root CAs, self-signed certs that are no longer used.
• On models with “Require Trusted Certificate” or “Validate Server Certificate”, that box enforces full chain checks. It’s good for security, but only if the right CAs are installed and hostnames line up.
Clean up those mismatches and most “Xerox 016-749 certificate chain invalid” alerts disappear immediately.

Customer

Some guides say to just disable “validate server certificate” or “require trusted certificate”. Is that safe as a quick fix?

Technician

Step 4 — Tuning “Require trusted certificate” (without breaking security)
If you uncheck “validate/require trusted certificate”, the Xerox stops rejecting chains and 016-749 may vanish — but:
• You lose strict TLS verification and could, in theory, accept a spoofed SMTP server.
• Many orgs must keep certificate validation enabled for compliance.
A safer pattern:
1) Install correct CA chain → test with “Require trusted certificate” enabled.
2) Only if your provider officially recommends it (or you’re using a known-good relay that can’t present a proper chain) should you temporarily relax validation.
If you’re unsure which option fits your security policy, jump into chat — we’ll review your SMTPS, TLS, and certificate settings line by line.

Customer

What about multiple Xerox devices and mixed models (AltaLink, VersaLink) all failing after a change? Can we standardize this so 016-749 stops everywhere?

Technician

Great question — 016-749 often turns into a fleet-wide headache.
For multiple AltaLink / VersaLink / WorkCentre devices:
• Use the same SMTP hostname, port, and encryption method on all devices that matches your mail provider’s latest requirements.
• Import the same trusted root and intermediate certificates to each device (or push via Xerox management tools where supported).
• Enforce a consistent policy: TLS 1.2+, STARTTLS on 587 or SSL/TLS on 465, and “Require trusted certificate” ON only once you know all chains validate.
• Keep firmware current so the devices understand modern ciphers and certificate requirements used by Microsoft 365 and other providers.
Done right, you eliminate recurring Xerox 016-749 SMTPS certificate chain invalid faults across the environment.

Customer

If we fix the certificates and it still fails with 016-749, what else should we check before calling support?

Technician

Step 6 — Final checks for stubborn 016-749 errors
Before escalating:
• Verify DNS on the Xerox: it must resolve your SMTP FQDN to the correct IP.
• Ensure the device’s date and time are correct — expired/“not yet valid” certs trigger chain failures.
• Confirm no SSL inspection proxy is breaking the chain between Xerox and the internet.
• Test SMTPS from a laptop on the same subnet; compare certificate details to what you imported.
If all of that looks clean and 016-749 certificate chain invalid persists, it’s time for a model-specific review. An expert can quickly spot subtle mismatches in logs or recommend a targeted firmware update.

Customer

Got it. So fixing the trusted CA chain, hostname, and TLS version should solve Xerox 016-749 in most cases?

Technician

Exactly. In real environments, resolving Xerox 016-749 — SMTPS certificate chain invalid comes down to:
• Correct SMTP host, port, and encryption (STARTTLS 587 or SSL/TLS 465).
• Installing the proper root and intermediate certificates so the chain validates.
• Matching hostnames and keeping device time/firmware up to date.
• Using “Require trusted certificate” intelligently instead of turning security off blindly.
Follow those steps and scan to email should be stable again. Want someone to double-check your config live? Open the chat and an expert will walk through it with you.

Quick answer: the accepted fix

Accepted fix for Xerox 016-749 “certificate chain invalid” on SMTPS / scan to email: confirm correct SMTP host, port and STARTTLS/SSL setting, install the matching root and intermediate CA certificates on the Xerox, ensure date/time and hostname match the server certificate, then test with “Require trusted certificate” enabled. If anything is unclear, jump into chat with an expert.

FAQ

Step-by-step: fix Xerox 016-749 certificate chain invalid (SMTPS)

1. In the Xerox Embedded Web Server, confirm the correct SMTP hostname, port (587 or 465), and STARTTLS/SSL setting.
2. Run an SMTP TLS test from a PC to view the server’s full certificate chain and note the root and intermediate CAs.
3. Download those CA certificates from the official provider and import them into the Xerox trusted certificate store.
4. Ensure the device date/time and DNS are correct, and the SMTP hostname matches the certificate CN/SAN.
5. Keep “Require trusted certificate” enabled if the chain now validates; send a scan to email test to confirm 016-749 is resolved.

Note for mixed environments (macOS, Linux, appliances)

1. Use the same SMTP hostname and TLS requirements across Xerox, servers, and apps so certificates and policies stay aligned.
2. If you introduce new mail gateways or filtering appliances, update the trusted CA set on Xerox devices at the same time.

Sources

• Xerox — Working With Digital Certificates
• Xerox — Configure Settings for SSL/TLS
• Forward Email — Printer & MFP SMTP/TLS compatibility guide

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.