0

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com is using a TLS certificate issued to mail.protection.outlook.com.

Both the mail server hostname and TLS certificate common name belong to the same subdomain: protection.outlook.com

I'm trying to understand what's happening. Am I expected to ignore this kind of name mismatch?

This report seems to point out that there's something wrong:

hotmail.com TLS report

Edit 2018-08-04

Report link: https://ssl-tools.net/mailservers/hotmail.com

Improve this question
4
  • 1
    looks to me like the server is using SNI(en.wikipedia.org/wiki/Server_Name_Indication). what does the report state the problem as?
    – JOW
    Commented Aug 4, 2018 at 8:13
  • 1
    Report: ssl-tools.net/mailservers/…
    – StackzOfZtuff
    Commented Aug 4, 2018 at 9:41
  • 2
    @JOW Looking up MX records for hotmail.com I get only hotmail-com.olc.protection.outlook.com, and it seems this mail server doesn't have a valid certificate for this hostname, which makes me believe SNI is not being used here. Mayabe I'm missing a step.
    – Thomas C. G. de Vilhena
    Commented Aug 4, 2018 at 13:55
  • 1
    They've had invalid ssl certificates for years. As I work in custom smtp software, they are a big headache.
    – jjxtra
    Commented Mar 5, 2019 at 17:40

2 Answers 2

Reset to default
-1

It's currently fixed (2020-01-11), Certificate chain is valid:

mail.protection.outlook.com
128 days remaining / 2048 bit / sha256WithRSAEncryption

GlobalSign Organization Validation CA - SHA256 - G3
2062 days remaining / 2048 bit / sha256WithRSAEncryption

GlobalSign Root CA (Certificate is self-signed.)
2939 days remaining / 2048 bit / sha1WithRSAEncryption

Report:

🙂

Improve this answer
-1

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com

How often do you send messages to (mailbox)@hotmail-com.olc.protection.outlook.com?

Where did you get hotmail-com.olc.protection.outlook.com from?

The certificate needs to match the MX record for the domain. When I check:

 $ nslookup
 > set type=MX
 > outlook.com
 Server:         127.0.1.1
 Address:        127.0.1.1#53

 Non-authoritative answer:
 outlook.com     mail exchanger = 5 outlook-com.olc.protection.outlook.com.

Unfortunately Thomas left off the part of the screen shot which explains why the certificate presented there is valid - it is because one of the subject alternate names is *.olc.protection.outlook.com which also matches the address you cited.

enter image description here

Improve this answer
1
  • Back then I was developing a custom Mail Submission Agent and when executing a STARTTLS command against hotmail.com servers (after resolving the domain MX records) the application was failing to validate the provided certificate. Today I remembered about it and decided to check it again, and it was fixed!
    – Thomas C. G. de Vilhena
    Commented Jan 12, 2020 at 2:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .