0

We have configured IronPort, DLP and SMTP in my organization. Now I am getting an error message:

statin - : TLS handshake could not be completed".

Questions:

  1. Can anyone please tell me whether Ironport should have the public key in SMTP?

  2. Do wee need public key from Ironport for SSL encryption?

1
  • Yes a cert is needed for inbound, and yes for Outbound if IronPort handles outbound SMTP.
    – TheCleaner
    Oct 7, 2014 at 14:34

1 Answer 1

0

Your Ironport is failing the set up an encrypted TLS session for mail transfer.

Possibly, either your Destination Controls or HAT Policy is mandating encryption, or the remote end is mandating it.

You need to have a Certificate installed and configured in order for incoming SSL/TLS to work. This may be self-signed, but if it is then a remote side cannot have a policy of verification.

If you have a Destination Control mandating verified encryption to a remote domain, and their certificate is expired or has an invalid chain, then you will not be able to set up TLS. Similarly, remote sites mandating validated certificate will not be able to connect to you if you have an expired or self-signed certificate.

If you have 'encryption preferred', as most domains so then it should fall back to an unencrypted link and so your email will still flow.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .