What's the best way to check if an SMTP server is SSL-enabled or not?

Question

What's the best way to check if an SMTP server is SSL-enabled or not?

Follow-up question: How do I make it SSL-enabled if it's not yet SSL-enabled.

The OS is CentOS.

Answer 1

That depends whether you mean SSL or TLS.

• SSL has it's own dedicated port at TCP/465. The best way to test for it's presence would be to use OpenSSL's wonderful s_client which will negotiate the SSL trickery for you.

  openssl s_client -connect localhost:465
  

  If your server isn't bound to localhost then obviously replace that with the IP or hostname.

• TLS looks just like normal SMTP at first. The encryption is negotiated from and on-top of the plain-text protocol. You can test whether it is available by issuing an EHLO request to the server. You can use Netcat or Telnet clients for this.

  $ nc -v localhost 25
  localhost [127.0.0.1] 25 (smtp) open
  220 mail.example.com ESMTP Exim 4.69 Fri, 11 Sep 2009 09:25:20 +0100
  ehlo test
  250-mail.example.com Hello localhost [127.0.0.1]
  250-SIZE 10485760
  250-PIPELINING
  250-STARTTLS
  250 HELP
  

  The important line is second from last which advertises the STARTTLS capability.

In order to say how to enable SSL/TLS for your mail server you'll need to tell us what mail package you're using.

Answer 2

If you are running CentOS, you are probably using Sendmail. Install the Sendmail-mc package. Inside the /etc/mail/sendmail.mc are some directives for you to look into for TLS:

dnl # Rudimentary information on creating certificates for sendmail TLS:
dnl #     cd /usr/share/ssl/certs; make sendmail.pem
dnl # Complete usage:
dnl #     make -C /usr/share/ssl/certs usage
dnl #
dnl define(`confCACERT_PATH', `/etc/pki/tls/certs')dnl
dnl define(`confCACERT', `/etc/pki/tls/certs/ca-bundle.crt')dnl
dnl define(`confSERVER_CERT', `/etc/pki/tls/certs/sendmail.pem')dnl
dnl define(`confSERVER_KEY', `/etc/pki/tls/certs/sendmail.pem')dnl

Once you have that working, you can enable Sendmail over SSL with something like so:

DAEMON_OPTIONS(`Addr=142.46.200.221, Port=465, Name=SSA, M=Eas')

Oh, and block a bunch of time to play with it before you get it right.

When I've done this, I've almost always had to run three instances of sendmail:

• one with TLS enabled on port 587 with the various SMTP-AUTH configurations (so authenticated remote users can send arbitrary mail);
• one with SSL enabled on port 465 with the various SMTP-AUTH configurations (same reason, different clients (thank you Microsoft Outlook "Express"); and
• one with TLS enabled but no AUTH, locked down so that it only receives mail for valid local recipiants (remote senders can use TLS or not as they like).

Each one had a separate config file. There should be a way to get the first two to run as the same instance listening on both ports, but I could never get it to work right.

If you get big enough, these different instances can get run on different machines.