A couple of months ago, my company bought a Rapid SSL Certificate which supports until 256-bits cryptography and which is used both for communication between our mobile apps and our server and to send emails by our SMTP server, which is also inside our Windows Server 2012 R2. I correctly managed to install it by IIS 6 in a custom SMTP server. Everything seems to work fine but only a company associated with ours told us that our SMTP server cannot connect to their incoming email server because

the certificate we use could not be "compatible" with new SHA256 cryptography standards.

I don't know exactly what this means but I called our certificate provider and they assured us the certificate we bought is correct. Moreover, I am quite sure that company is wrong because our SMTP certificate is able to connect not only to Gmail accounts but also to many other incoming email servers using that certificate. And messages have always been correctly delivered. So, I don't know where and how to investigate for the problem.

Generally, our SMTP server is evoked by .NET web applications deployed on our server Windows 2012 R2 like the following:

IDMailer M = null;
M = (IDMailer)new IDMailer();
M.FromAddress = new IDVariant(v_VEMAILRESIDE).stringValue();
M.Subject = IDL.FormatMessage((new IDVariant("|1: manutenzione ODL |2")), v_VNOMERESIDEN, v_ODL).stringValue();
M.SetRelayServer((new IDVariant("www.ourserver.it")).stringValue(), (new IDVariant(25)).intValue(), (new IDVariant("username")).stringValue(), (new IDVariant("password")).stringValue(),(new IDVariant(-1)).booleanValue()); 
M.HTMLBody = new IDVariant(v_HTML_MESSAGE).stringValue();

As you can see, the IDMailer (from framework System.Net.Mail) is set both to use our server as relay and to use cryptography to connect to relay (last parameter). Thus, I don't really know where to investigate for the problem or even whether the problem exists and is ours.


As suggested, I try to analyze the mail servers with this site using one of our customers email in order to test the secure connection to their incoming mail server.

This is a first summary report:

enter image description here

from which I got confirmation that their authoritative incoming mail server are the first two. Then, this is the log of the first server (the one the second is identical)

enter image description here

from which I understood the problem might be theirs, as

TLS in not an option on this server

I mean that it might be their server which do not support TLS. Thus, as our SMTP server exclusively works with a SSL certificate, then it cannot connect to their incoming mail server. Am I right or am I missing anything else?

  • SSL for SMTP has always been fiddly; you'll probably need to use openssl s_client (or equivalent) and connect to their server and then see exactly how that fails to determine what is going on. – thrig Feb 14 '17 at 17:17
  • @thrig thank you very much for your kind message. I will have a trial tomorrow as soon as I have arrived at the office. Please, would you explain better how to use openssl s_client in this case? Shall I set it to use our SMTP sever as relay? How? Or also if you have a tutorial/documentation to link me because I'm a complete ignorant in this matter. – Lory Lory Feb 14 '17 at 17:30
  • Moreover I don't know the name or the IP of their incoming email server and they won't tell me. I just know their email domain like user@companyname.it – Lory Lory Feb 14 '17 at 17:48
  • If they say that your certificate is too bad to connect to their server (and not the other way) then you are probably complaining a client certificate you use. Unfortunately openssl s_client or equivalent will not help here. Instead you need to check any configuration for client certificate (no idea where this is at your server). Alternatively you might do a traffic capture of the connection from your SMTP server to some other server and provide this capture for analysis. Or you might ask this company for deeper technical details, i.e. how they got to their problem description. – Steffen Ullrich Feb 14 '17 at 18:03
  • A nslookup on type MX for companyname.it should show their mail servers. (Or A or AAAA lookups if they don't have any MX.) – thrig Feb 14 '17 at 18:13

have you tried a site like http://checktls.com? I used it when we had a company report that they were receiving random cert errors when connecting to our mail servers. Was able to determine that one box had the incorrect cert applied.

  • Thank you mate, very kind of yours. I have to study how that site works But it looks interesting so I will have a test with that site next monday as soon as I'm at the office. I'll let you know here because I'm sure I will make a mess. Thank you :) – Lory Lory Feb 17 '17 at 20:29
  • forgive me for the late. I tried to test things with the site you suggested to me and I've juts updated my answer if you want to have a look... – Lory Lory Feb 21 '17 at 10:22

That error message looks more like they have a problem with the signature on your Windows server. That is separate from the SSL certificate which applies to the connection but not the identity of your server. Windows likes to sign things with a MD5 security wrapper unless you specifically say otherwise. MD5 was broken so certs wrapped using MD5 are no longer a valid check of identification. You'll need to check and reissue the cert which identifies your mail server to one wrapped with SHA256.

  • Thank you very much mate, not it sounds a little clearer. But, how have you understood there's a problem with our Windows Server? Because I did not give checktls.com any parameter to use our SMTP server...just a destination email of our customers. Moreover, how can I "check and reissue" our certificate with SHA256? Shall I call our certificate provider or shall I execute anything on Wndows Server? Forgive me for all these questions because I am a bad System Engineer – Lory Lory Feb 21 '17 at 11:09
  • So the website that the other answer sent you two it's for checking the destinations TLS compatibility. It looks like the error message you received was from when you were trying to connect from your domain. The information from checktls website isn't throwing the sha256 error message because their server cert is wrapped with sha256 already. – Rowan Hawkins Feb 21 '17 at 11:17
  • I've just tried to exec the test from the site through Google Chrome but this it I run it in my Windows Server 2012. I get the same result. So now, what exactly should I do? Shall I wrap my certificate with SHA256? if yes, how? – Lory Lory Feb 21 '17 at 11:30
  • Our domain isn't running 2012 and also we have hosted exchange so I cant look at an instance to say for sure. What I mentioned was because one of our clients created a cert from a CRL, on a MS server and had that exact error when we installed their provided cert on our system. They later provided a cert wrapped in sha256 and that worked fine. – Rowan Hawkins Feb 22 '17 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.