problems with TLS

[tminchin_ironport]

Hi,

Is anyone else having problems with doing TLS as preferred? We have found this issue:

1) if the remote site offers TLS but it does not work, the Ironport is unable to send the email and eventually it gets too old and is return to the sender as undeliverable. The Ironport does not appear to be able to:
a. try one of the other MXs
b. failover to vanilla SMTP (as per the manual)

We realise that you can't just stop doing TLS mid-stream - but surely it would be helpful if the connection timed out and the message was requeued then something was wrong with TLS and maybe try without it.

Given that a bucket load of Exchange servers advertise they do TLS even though it is not configured, it would nice to have the Ironport failover to vanilla SMTP without human intervention.

[Corey_ironport]

We had this problem before we actually set up TLS on the IronPorts. Once we received our signed certs from Verisign, and added them to the appliances, it quit happening.

[tminchin_ironport]

We have third party signed certificates - Comodo ones. Maybe it is the lack of intermediate CA support which is stoping it working.