ERROR: self signed certificate

I was also able to run into this error and I also manged to bring n8n into a boot loop with the IMAP Email Read Node. I got a similiar setup like the TO with a nginx reverse proxy in front, which is working fine normally. I also removed the N8N_Host env but it kept restarting.

I don’t know exactly what the problem is but at least I can offer a solution when someone else runs into such a boot loop where the docker container keeps restarting. This is also still happening after recreating the container so you have to manually change files to stop the IMAP Read Node function.

The main problem was - which one should not do: activate the workflow to production while there is an error accuring. Tthe error made the docker container force restarting after 5 seconds. In the end I did the following:

Search for the

/var/lib/docker/overlay2/------------containerID------------/diff/usr/local/lib/node_modules/n8n/node_modules/imap/lib/Connection.js

file on the host computer for example with this command find / -name "Connection.js - attention there are several files, you need to choose the right one.

When you got the right one I did the following - Do not copy/paste the commands! You need to manually find your corresonding file depending on your container id:

// Stop the docker container, in my case:
docker stop n8n_n8n_1
// Make a backup of the Connection.js
cp Path to your container/diff/usr/local/lib/node_modules/n8n/node_modules/imap/lib/Connection.js Path to your container/diff/usr/local/lib/node_modules/n8n/node_modules/imap/lib/Connection.js.bkk
// Empty the file -> dont delete it, it has to be there
touch > /usr/local/lib/node_modules/n8n/node_modules/imap/lib/Connection.js 
// Start the docker container again
docker start n8n_n8n_1

n8n should start again and you can turn of the corresponding workflow which is responsible for the error (in my case the IMAP Read Email Node/workflow).

After this you should stop the container again and move the Connection.js.bkk back to it’s normal place. Other option would be after deactivating the Workflow/Node to stop the container, remove it and rebuild it.

At this point I didn’t find out why it is happening but it seems to be a gmail problem. Will look into it after work.

Edit:
The IMAP Node doesn’t seem to work with gmail at my end. Can someone test this on his side? When using a private mail account/domain the node is working proberly. Also changing the google settings to allow unsecure apps/login methods does not help in this case. Perhaps it’s something with the reverse proxy? Docker error logs look like this:

Error [ERR_STREAM_DESTROYED]: Cannot call write after a stream was destroyed
    at doWrite (_stream_writable.js:399:19)
    at clearBuffer (_stream_writable.js:542:7)
    at Socket.Writable.uncork (_stream_writable.js:338:7)
    at JSStreamSocket.doWrite (internal/js_stream_socket.js:176:17)
    at JSStream.onwrite (internal/js_stream_socket.js:33:57)
    at Socket.ondata (internal/js_stream_socket.js:77:22)
    at Socket.emit (events.js:314:20)
    at addChunk (_stream_readable.js:298:12)
    at readableAddChunk (_stream_readable.js:273:9)
    at Socket.Readable.push (_stream_readable.js:214:10)
Emitted 'error' event on TLSSocket instance at:
    at TLSSocket._emitTLSError (_tls_wrap.js:893:10)
    at JSStreamSocket.<anonymous> (_tls_wrap.js:813:36)
    at JSStreamSocket.emit (events.js:314:20)
    at Socket.<anonymous> (internal/js_stream_socket.js:63:38)
    at Socket.emit (events.js:314:20)
    at errorOrDestroy (internal/streams/destroy.js:108:12)
    at onwriteError (_stream_writable.js:418:5)
    at onwrite (_stream_writable.js:445:5)
    at doWrite (_stream_writable.js:399:11)
    at clearBuffer (_stream_writable.js:542:7) {
  code: 'ERR_STREAM_DESTROYED'
}

parts of docker-compose:

    ports:
      - "127.0.0.1:5678:5678"
    environment:
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER
      - N8N_BASIC_AUTH_PASSWORD
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - NODE_ENV=production
      - VUE_APP_URL_BASE_API=https://xxx.domain.com/
      - WEBHOOK_TUNNEL_URL=https://xxx.domain.com/

.env:

DATA_FOLDER=/var/n8n/
DOMAIN_NAME=domain.com
SUBDOMAIN=xxx
N8N_BASIC_AUTH_USER=xxx
N8N_BASIC_AUTH_PASSWORD=xxxx
GENERIC_TIMEZONE=Europe/Berlin

@jan I found a workaround to make gmail accounts work. Perhaps it’s possible to add this tlsOption which i manually added to the Connection.js to the chooseable options in the webUI.

I added the following to the tlsOptions, line 119:

// old code
        tlsOptions = {};
// new code
        tlsOptions = { rejectUnauthorized: false };

Edit: it is working! for gmail and private accounts. just remember to lower the gmail login security and allow login by unsecure apps.