Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am in a situation where a web application is using the IIS virtual SMTP server to send out email. The IIS virtual SMTP server is then configured to send all mail out through a smarthost, over TLS encryption. This is working, except that through testing, it appears that IIS is not verifying the hostname it connects to in the remote certificate. Because of this, I believe it could be possible for someone to perform a man-in-the-middle attack. (The second SMTP relay is not located in the same datacenter, and is not connecting over a VPN).

Is there anyway to configure IIS virtual SMTP server 6.0 to verify the hostname in the outgoing TLS connection?

Thanks!

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.