07-15-2009 08:19 AM
Hi.
We have 2 C350, and would like to setup TLS. I have found the document "Encrypting SMTP Conversations Using TLS".
My question is, should i use 2 certificates og just 1.
Best regards
Thorsten
07-15-2009 06:24 PM
For SMTP over TLS you would require one cert only and this would be validated by remote MTA's for incoming traffic at your end.
-Kishore
07-16-2009 08:04 AM
For SMTP over TLS you would require one cert only and this would be validated by remote MTA's for incoming traffic at your end.
-Kishore
07-16-2009 08:20 PM
This could be a useful article in setting up TLS from receiving and delivery once you have completed the above steps.
http://tinyurl.com/g6c3m
In regard to using 1 or 2 certs. If these two C350's are going to sit behind a load balancer and there is only one PTR record then you would apply 1 cert on both the appliances.
If they would have different PTR records then you might need 2 different certs. However, if you plan to use a wild card cert it makes things easier to just have one cert.
-Kishore
07-28-2009 03:36 PM
Hi,
that still applies if i have two A records with the IP's of my IronPorts behind my MX, right ? [...] Both are using their hostnames in the smtp banner, so the cert should point on each hostname? please correct me if i'm on the woodway :roll:
best regards,
rob
07-28-2009 05:51 PM
Yes this is correct, Since there would be two different hostnames PTR records for these appliances. You might want use one cert on each or get a Wildcard cert or get a cert with two subject names (one of the hostname).
Hope this helps!
Cheers,
Kishore
07-29-2009 06:45 AM
yes,
thanks a lot :)
08-07-2009 08:22 PM
Please be careful! Trusting TLS as a full blown encryption solution might not de correct.
TLS is always a point to point encryption. This is OK as long as you are sure that remote server is also in a protected environment. But.... if the system you are communicating with is for instance Message labs you have no control over the encryption between Message labs and the final recipient. This means you have nicely secured your communication with Message labs but your message contents can still be sniffed while the message has left Message labs. Of course this is the case with every external hosted mail relay (if your provider delivers you backup MX services you might have the same issue)
If you want to be sure only the intended recipient can decode the message you must use some other (more expensive and complex) encryption mechanisms.
I'm not saying TLS is useless but its added value should be considered "limited"
Steven
08-07-2009 08:42 PM
With some hosted vendors, they can find to see if a message was transmitted via TLS tunnel if so, they can automatically deliver the message via TLS tunnel to the recipient MTA. However, I believe this needs to be configured and setup with your hosted service if plan to use this method.
Agree that TLS is not a full encryption solution, so is why with SMTP TLS and it is called gateway-gateway encryption and not an end-end encryption.
08-12-2009 09:23 AM
youre right. for those who need it, we have PGP in place also. 8)
thanks, rob :wink:
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide