2

I have exchange 2010 on a 64-bit Windows Server 2008 R2 VM. I am using an SSL multi domain certificate from a certificate authority with IIS and SMTP services enabled. My goal is to setup assured/forced/mandatory/whatever-you-call-it TLS (not opportunistic) with the domain checktls.com. Before setting up any send/receive connectors with them I do their TestReceiver (http://checktls.com/perl/TestReceiver.pl) with all results ok and in the green.

  • Connected to server
  • We are allowed to connect
  • we can use this server
  • TLS is an option on this server
  • STARTTLS command works on this server
  • Connection converted to SSL
  • (cert data)
  • Cert VALIDATED: ok
  • Cert Hostname VERIFIED
  • TLS successfully started on this server
  • Sender is OK
  • Recipient OK, e-mail address proofed
  • QUIT

Next I do their TestSender (http://checktls.com/perl/TestSender.pl) and the email comes back "SUCCESSFUL" with the confident text of "Your email was successfully sent securely using TLS."

Now for the connectors. In exchange, I create a new send connector named "CheckTLS" with the intended use of "Partner". Address space is "checktls.com" with "Include all subdomains" checked (Cost = 1). "Enable Domain Security (Mutual Auth TLS)" is checked.

I create a new receive connector named "CheckTLS" with the intended use of "Partner", port 25, and remote ip address of 69.61.187.232 (CheckTLS's ip address). "Transport Layer Security (TLS)" and "Enable Domain Security (Mutual Auth TLS)" are the only things checked on the Authentication tab. Permission groups has "Partners" and "Anonymous" checked.

I issue the powershell commands...

set-transportconfig -TLSReceiveDomainSecureList checktls.com

set-transportconfig -TLSSendDomainSecureList checktls.com

And here is where everything breaks...

CheckTLS's TestReceiver test has the following details...

  • Connected to server
  • We are allowed to connect
  • we can use this server
  • TLS is an option on this server
  • STARTTLS command works on this server
  • Connection converted to SSL
  • (cert data)
  • Cert VALIDATED: ok
  • Cert Hostname VERIFIED
  • TLS successfully started on this server
  • Read failed (reason: timed out )
  • Cannot proof e-mail address (reason: MAIL FROM rejected)
  • Note:This does not affect the CheckTLS Confidence Factor
  • QUIT
  • 530 5.7.1 Not authenticated

My ReceiveSMTP logs on exchange look like this...

2014-09-17T18:57:43.290Z,MAIL\CheckTLS,08D1A0B838DEF207,0,10.10.30.9:25,69.61.187.232:56543,+,,
2014-09-17T18:57:43.290Z,MAIL\CheckTLS,08D1A0B838DEF207,1,10.10.30.9:25,69.61.187.232:56543,*,SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders,Set Session Permissions
2014-09-17T18:57:43.290Z,MAIL\CheckTLS,08D1A0B838DEF207,2,10.10.30.9:25,69.61.187.232:56543,>,"220 MAIL.EXAMPLE.COM Microsoft ESMTP MAIL Service ready at Wed, 17 Sep 2014 13:57:42 -0500",
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,3,10.10.30.9:25,69.61.187.232:56543,<,EHLO checktls.com,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,4,10.10.30.9:25,69.61.187.232:56543,>,250-MAIL.EXAMPLE.COM Hello [69.61.187.232],
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,5,10.10.30.9:25,69.61.187.232:56543,>,250-SIZE 10485760,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,6,10.10.30.9:25,69.61.187.232:56543,>,250-PIPELINING,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,7,10.10.30.9:25,69.61.187.232:56543,>,250-DSN,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,8,10.10.30.9:25,69.61.187.232:56543,>,250-ENHANCEDSTATUSCODES,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,9,10.10.30.9:25,69.61.187.232:56543,>,250-STARTTLS,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,10,10.10.30.9:25,69.61.187.232:56543,>,250-AUTH,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,11,10.10.30.9:25,69.61.187.232:56543,>,250-8BITMIME,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,12,10.10.30.9:25,69.61.187.232:56543,>,250-BINARYMIME,
2014-09-17T18:57:43.337Z,MAIL\CheckTLS,08D1A0B838DEF207,13,10.10.30.9:25,69.61.187.232:56543,>,250 CHUNKING,
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,14,10.10.30.9:25,69.61.187.232:56543,<,STARTTLS,
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,15,10.10.30.9:25,69.61.187.232:56543,>,220 2.0.0 SMTP server ready,
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,16,10.10.30.9:25,69.61.187.232:56543,*,,Sending certificate
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,17,10.10.30.9:25,69.61.187.232:56543,*,"CN=MAIL.EXAMPLE.COM, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated",Certificate subject
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,18,10.10.30.9:25,69.61.187.232:56543,*,"CN=PositiveSSL CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB",Certificate issuer name
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,19,10.10.30.9:25,69.61.187.232:56543,*,0011001001001001000100,Certificate serial number
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,20,10.10.30.9:25,69.61.187.232:56543,*,000011100011100001110001100,Certificate thumbprint
2014-09-17T18:57:43.384Z,MAIL\CheckTLS,08D1A0B838DEF207,21,10.10.30.9:25,69.61.187.232:56543,*,MAIL.EXAMPLE.COM;AUTODISCOVER.EXAMPLE.COM;WEBMAIL.EXAMPLE.COM,Certificate alternate names
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,22,10.10.30.9:25,69.61.187.232:56543,<,EHLO checktls.com,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,23,10.10.30.9:25,69.61.187.232:56543,*,,TlsDomainCapabilities='None'; Status='NoRemoteCertificate'
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,24,10.10.30.9:25,69.61.187.232:56543,>,250-MAIL.EXAMPLE.COM Hello [69.61.187.232],
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,25,10.10.30.9:25,69.61.187.232:56543,>,250-SIZE 10485760,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,26,10.10.30.9:25,69.61.187.232:56543,>,250-PIPELINING,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,27,10.10.30.9:25,69.61.187.232:56543,>,250-DSN,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,28,10.10.30.9:25,69.61.187.232:56543,>,250-ENHANCEDSTATUSCODES,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,29,10.10.30.9:25,69.61.187.232:56543,>,250-AUTH,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,30,10.10.30.9:25,69.61.187.232:56543,>,250-8BITMIME,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,31,10.10.30.9:25,69.61.187.232:56543,>,250-BINARYMIME,
2014-09-17T18:57:43.883Z,MAIL\CheckTLS,08D1A0B838DEF207,32,10.10.30.9:25,69.61.187.232:56543,>,250 CHUNKING,
2014-09-17T18:57:43.945Z,MAIL\CheckTLS,08D1A0B838DEF207,33,10.10.30.9:25,69.61.187.232:56543,<,MAIL FROM:<test@checktls.com>,
2014-09-17T18:57:43.945Z,MAIL\CheckTLS,08D1A0B838DEF207,34,10.10.30.9:25,69.61.187.232:56543,*,Tarpit for '0.00:00:30',
2014-09-17T18:58:13.959Z,MAIL\CheckTLS,08D1A0B838DEF207,35,10.10.30.9:25,69.61.187.232:56543,>,530 5.7.1 Not authenticated,
2014-09-17T18:58:13.959Z,MAIL\CheckTLS,08D1A0B838DEF207,36,10.10.30.9:25,69.61.187.232:56543,<,QUIT,
2014-09-17T18:58:13.959Z,MAIL\CheckTLS,08D1A0B838DEF207,37,10.10.30.9:25,69.61.187.232:56543,>,221 2.0.0 Service closing transmission channel,
2014-09-17T18:58:13.959Z,MAIL\CheckTLS,08D1A0B838DEF207,38,10.10.30.9:25,69.61.187.232:56543,-,,Local

Because I now cannot receive anything from CheckTLS, I cannot see the results of their CheckSender test, but my exchange server's SendSMTP logs show the following...

2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,10,10.10.30.9:63267,69.61.187.246:25,<,220 Ready to start TLS,
2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,11,10.10.30.9:63267,69.61.187.246:25,*,,Sending certificate
2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,12,10.10.30.9:63267,69.61.187.246:25,*,"CN=mail.EXAMPLE.COM, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated",Certificate subject
2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,13,10.10.30.9:63267,69.61.187.246:25,*,"CN=PositiveSSL CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB",Certificate issuer name
2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,14,10.10.30.9:63267,69.61.187.246:25,*,1110010101010101010101001111,Certificate serial number
2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,15,10.10.30.9:63267,69.61.187.246:25,*,1100101001001010010101001010101010101,Certificate thumbprint
2014-09-17T19:13:00.085Z,CheckTLS,08D1A0B838DEF26D,16,10.10.30.9:63267,69.61.187.246:25,*,MAIL.EXAMPLE.COM;AUTODISCOVER.EXAMPLE.COM;WEBMAIL.EXAMPLE.COM,Certificate alternate names
2014-09-17T19:13:00.194Z,CheckTLS,08D1A0B838DEF26D,17,10.10.30.9:63267,69.61.187.246:25,*,,Received certificate
2014-09-17T19:13:00.194Z,CheckTLS,08D1A0B838DEF26D,18,10.10.30.9:63267,69.61.187.246:25,*,11010010010010101010010101001001001,Certificate thumbprint
2014-09-17T19:13:00.194Z,CheckTLS,08D1A0B838DEF26D,19,10.10.30.9:63267,69.61.187.246:25,>,EHLO MAIL.EXAMPLE.COM,
2014-09-17T19:13:00.241Z,CheckTLS,08D1A0B838DEF26D,20,10.10.30.9:63267,69.61.187.246:25,<,"250-ts3.checktls.com Hello mail.EXAMPLE.COM [1.2.3.4], pleased to meet you",
2014-09-17T19:13:00.241Z,CheckTLS,08D1A0B838DEF26D,21,10.10.30.9:63267,69.61.187.246:25,<,250-ENHANCEDSTATUSCODES,
2014-09-17T19:13:00.241Z,CheckTLS,08D1A0B838DEF26D,22,10.10.30.9:63267,69.61.187.246:25,<,250-8BITMIME,
2014-09-17T19:13:00.241Z,CheckTLS,08D1A0B838DEF26D,23,10.10.30.9:63267,69.61.187.246:25,<,250 HELP,
2014-09-17T19:13:00.241Z,CheckTLS,08D1A0B838DEF26D,24,10.10.30.9:63267,69.61.187.246:25,*,2238593,sending message
2014-09-17T19:13:00.241Z,CheckTLS,08D1A0B838DEF26D,25,10.10.30.9:63267,69.61.187.246:25,>,MAIL FROM:<ME@EXAMPLE.COM>,
2014-09-17T19:13:00.288Z,CheckTLS,08D1A0B838DEF26D,26,10.10.30.9:63267,69.61.187.246:25,<,250 Ok - mail from ME@EXAMPLE.COM,
2014-09-17T19:13:00.288Z,CheckTLS,08D1A0B838DEF26D,27,10.10.30.9:63267,69.61.187.246:25,>,RCPT TO:<test@TestSender.CheckTLS.com>,
2014-09-17T19:13:00.350Z,CheckTLS,08D1A0B838DEF26D,28,10.10.30.9:63267,69.61.187.246:25,<,250 Ok - recipient test@TestSender.CheckTLS.com,
2014-09-17T19:13:00.350Z,CheckTLS,08D1A0B838DEF26D,29,10.10.30.9:63267,69.61.187.246:25,>,DATA,
2014-09-17T19:13:00.397Z,CheckTLS,08D1A0B838DEF26D,30,10.10.30.9:63267,69.61.187.246:25,<,354 Send data.  End with CRLF.CRLF,
2014-09-17T19:13:00.537Z,CheckTLS,08D1A0B838DEF26D,31,10.10.30.9:63267,69.61.187.246:25,<,250 Ok,
2014-09-17T19:13:00.553Z,CheckTLS,08D1A0B838DEF26D,32,10.10.30.9:63267,69.61.187.246:25,>,QUIT,
2014-09-17T19:13:00.600Z,CheckTLS,08D1A0B838DEF26D,33,10.10.30.9:63267,69.61.187.246:25,<,221 ts3.checktls.com closing connection,
2014-09-17T19:13:00.600Z,CheckTLS,08D1A0B838DEF26D,34,10.10.30.9:63267,69.61.187.246:25,-,,Local

The Event viewer in exchange shows an event id 11017 (MSExchangeTransport) with the message "A message from domain-secured domain 'CheckTLS.com' on connector 'CheckTLS' failed to authenticate because no Transport Layer Security (TLS) certificate was supplied. Contact the administrator for CheckTLS.com to resolve the problem, or remove the domain from the domain-secured list."

I have a Sonicwall NSA 2400 firewall, as I have read some TLS issues with Cisco firewalls doing something with TLS traffic. Nothing I have seen in the Sonicwall logs would indicate this is the issue.

Sorry for the bombardment of information, but I'm at my wits end trying to get this setup properly. Any recommendations on where I can go next would be appreciated. Once I get it working properly with CheckTLS, the plan is to set it up with actual business partners, but first I need all my ducks in a row.

Thank you kindly.

2

I had this same issue and found a solution here (first answer): http://community.spiceworks.com/topic/266218-exchange-2010-forcedtls-email-stuck-during-routing-phase

It involved unchecking the Mutual Auth TLS and setting it for encryption only - otherwise you would need the certs from the partner domains. Hope this helps.

0

I had this same issue when setting up a receive connector for mutual TLS for testing against checkTLS. I added checktls.com to the domain secure list and it fails after the mail:from portion in the SMTP logs (530 5.7.59 SMTP; Authentication failed during MAIL FROM).

The failure generated an event 11017 in the server logs (A message from domain-secured domain 'checktls.com' on connector 'Receive CheckTLS' failed to authenticate because no Transport Layer Security (TLS) certificate was supplied. Contact the administrator for checktls.com to resolve the problem, or remove the domain from the domain-secured list).

Reviewing the certificate, it looks like the host name in the cert is mail6.checktls.com. When I changed the entry in the domain secure list to mail6.checktls.com, the error went away.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.