From 830455d197957b2b00d92e4f4cbdfc94f92d05fe Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 21 Oct 2026 08:21:43 +0400
Subject: [PATCH] fix(mailer): keep certificate checks for Swoosh HTTP adapters

The TLS version override replaced all Hackney TLS defaults. On OTP 26+
this fails with cacerts: :undefined; on older OTP it skipped certificate
checks. Closes #7962 on the public tracker.
---
 changelog.d/mailer-tls-options.fix                       | 1 +
 lib/pleroma/emails/mailer.ex                             | 4 +++-
 test/pleroma/emails/mailer_test.exs                      | 9 +++++++++
 test/pleroma/user_test.exs                               | 4 +++-
 .../admin_api/controllers/admin_api_controller_test.exs  | 4 +++-
 5 files changed, 19 insertions(+), 3 deletions(-)
 create mode 100644 changelog.d/mailer-tls-options.fix

diff --git a/changelog.d/mailer-tls-options.fix b/changelog.d/mailer-tls-options.fix
new file mode 100644
index 000000000..fe17eea6d
--- /dev/null
+++ b/changelog.d/mailer-tls-options.fix
@@ -0,0 +1 @@
+Fix Swoosh HTTP mail adapters failing with `cacerts: :undefined` on OTP 26+
diff --git a/lib/pleroma/emails/mailer.ex b/lib/pleroma/emails/mailer.ex
index 2a80f8547..58ef7de94 100644
--- a/lib/pleroma/emails/mailer.ex
+++ b/lib/pleroma/emails/mailer.ex
@@ -39,7 +39,9 @@ defmodule Pleroma.Emails.Mailer do
     # temporary hackney fix until hackney max_connections bug is fixed
     # https://git.pleroma.social/pleroma/pleroma/-/issues/2101
     email =
-      Swoosh.Email.put_private(email, :hackney_options, ssl_options: [versions: [:"tlsv1.2"]])
+      Swoosh.Email.put_private(email, :hackney_options,
+        ssl_options: Pleroma.HTTP.TLS.ssl_options(versions: [:"tlsv1.2"])
+      )
 
     case enabled?() do
       true -> Swoosh.Mailer.deliver(email, parse_config(config))
diff --git a/test/pleroma/emails/mailer_test.exs b/test/pleroma/emails/mailer_test.exs
index 7a718c653..52b9c0687 100644
--- a/test/pleroma/emails/mailer_test.exs
+++ b/test/pleroma/emails/mailer_test.exs
@@ -52,4 +52,13 @@ defmodule Pleroma.Emails.MailerTest do
       subject: "Pleroma test email"
     )
   end
+
+  test "keeps certificate checks for HTTP API adapters" do
+    Mailer.deliver(@email)
+
+    assert_received {:email, %Swoosh.Email{private: %{hackney_options: hackney_options}}}
+
+    assert hackney_options[:ssl_options] ==
+             Pleroma.HTTP.TLS.ssl_options(versions: [:"tlsv1.2"])
+  end
 end
diff --git a/test/pleroma/user_test.exs b/test/pleroma/user_test.exs
index 63c0c2bb8..f5e6e20fe 100644
--- a/test/pleroma/user_test.exs
+++ b/test/pleroma/user_test.exs
@@ -533,7 +533,9 @@ defmodule Pleroma.UserTest do
       Pleroma.Emails.UserEmail.account_confirmation_email(registered_user)
       # temporary hackney fix until hackney max_connections bug is fixed
       # https://git.pleroma.social/pleroma/pleroma/-/issues/2101
-      |> Swoosh.Email.put_private(:hackney_options, ssl_options: [versions: [:"tlsv1.2"]])
+      |> Swoosh.Email.put_private(:hackney_options,
+        ssl_options: Pleroma.HTTP.TLS.ssl_options(versions: [:"tlsv1.2"])
+      )
       |> assert_email_sent()
     end
 
diff --git a/test/pleroma/web/admin_api/controllers/admin_api_controller_test.exs b/test/pleroma/web/admin_api/controllers/admin_api_controller_test.exs
index fc578d828..07288caa8 100644
--- a/test/pleroma/web/admin_api/controllers/admin_api_controller_test.exs
+++ b/test/pleroma/web/admin_api/controllers/admin_api_controller_test.exs
@@ -1044,7 +1044,9 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
       Pleroma.Emails.UserEmail.account_confirmation_email(first_user)
       # temporary hackney fix until hackney max_connections bug is fixed
       # https://git.pleroma.social/pleroma/pleroma/-/issues/2101
-      |> Swoosh.Email.put_private(:hackney_options, ssl_options: [versions: [:"tlsv1.2"]])
+      |> Swoosh.Email.put_private(:hackney_options,
+        ssl_options: Pleroma.HTTP.TLS.ssl_options(versions: [:"tlsv1.2"])
+      )
       |> assert_email_sent()
     end