For SMTP over TLS you would require one cert only and this would be validated by remote MTA's for incoming traffic at your end.
This could be a useful article in setting up TLS from receiving and delivery once you have completed the above steps.
In regard to using 1 or 2 certs. If these two C350's are going to sit behind a load balancer and there is only one PTR record then you would apply 1 cert on both the appliances.
If they would have different PTR records then you might need 2 different certs. However, if you plan to use a wild card cert it makes things easier to just have one cert.
that still applies if i have two A records with the IP's of my IronPorts behind my MX, right ? [...] Both are using their hostnames in the smtp banner, so the cert should point on each hostname? please correct me if i'm on the woodway :roll:
Yes this is correct, Since there would be two different hostnames PTR records for these appliances. You might want use one cert on each or get a Wildcard cert or get a cert with two subject names (one of the hostname).
Hope this helps!
Please be careful! Trusting TLS as a full blown encryption solution might not de correct.
TLS is always a point to point encryption. This is OK as long as you are sure that remote server is also in a protected environment. But.... if the system you are communicating with is for instance Message labs you have no control over the encryption between Message labs and the final recipient. This means you have nicely secured your communication with Message labs but your message contents can still be sniffed while the message has left Message labs. Of course this is the case with every external hosted mail relay (if your provider delivers you backup MX services you might have the same issue)
If you want to be sure only the intended recipient can decode the message you must use some other (more expensive and complex) encryption mechanisms.
I'm not saying TLS is useless but its added value should be considered "limited"
With some hosted vendors, they can find to see if a message was transmitted via TLS tunnel if so, they can automatically deliver the message via TLS tunnel to the recipient MTA. However, I believe this needs to be configured and setup with your hosted service if plan to use this method.
Agree that TLS is not a full encryption solution, so is why with SMTP TLS and it is called gateway-gateway encryption and not an end-end encryption.