cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
105
Views
5
Helpful
1
Replies
Beginner

Filter to check SSL/TLS version of email

I want to know if there is any option or workaround to identify emails connecting with TLS v1.0 and SSL v3.0 using content or message filters ?

1 REPLY 1

Re: Filter to check SSL/TLS version of email

This is a bit harder to do and I would first start investigating by simply searching the mail log on the console like:

 

grep "SSLv3 cipher" mail_logs

grep "TLSv1 cipher" mail_logs

grep "TLSv1.1 cipher" mail_logs

grep "TLSv1.2 cipher" mail_logs

 

this gives you the ICID's of the incoming messages back matching your search pattern.

 

Then you need to grep this ICID in smtp_logs to get the corresponding MID back.

On a busy server there will be multiple MID associated to a given ICID.

 

Hope that helps with your analysis.

 

-Marc