0

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com is using a TLS certificate issued to mail.protection.outlook.com.

Both the mail server hostname and TLS certificate common name belong to the same subdomain: protection.outlook.com

I'm trying to understand what's happening. Am I expected to ignore this kind of name mismatch?

This report seems to point out that there's something wrong:

hotmail.com TLS report

Edit 2018-08-04

Report link: https://ssl-tools.net/mailservers/hotmail.com

4

2 Answers 2

-1

It's currently fixed (2020-01-11), Certificate chain is valid:

mail.protection.outlook.com
128 days remaining / 2048 bit / sha256WithRSAEncryption


GlobalSign Organization Validation CA - SHA256 - G3
2062 days remaining / 2048 bit / sha256WithRSAEncryption


GlobalSign Root CA (Certificate is self-signed.)
2939 days remaining / 2048 bit / sha1WithRSAEncryption

Report:

🙂

-1

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com

How often do you send messages to (mailbox)@hotmail-com.olc.protection.outlook.com?

Where did you get hotmail-com.olc.protection.outlook.com from?

The certificate needs to match the MX record for the domain. When I check:

 $ nslookup
 > set type=MX
 > outlook.com
 Server:         127.0.1.1
 Address:        127.0.1.1#53

 Non-authoritative answer:
 outlook.com     mail exchanger = 5 outlook-com.olc.protection.outlook.com.

Unfortunately Thomas left off the part of the screen shot which explains why the certificate presented there is valid - it is because one of the subject alternate names is *.olc.protection.outlook.com which also matches the address you cited.

enter image description here

1
  • Back then I was developing a custom Mail Submission Agent and when executing a STARTTLS command against hotmail.com servers (after resolving the domain MX records) the application was failing to validate the provided certificate. Today I remembered about it and decided to check it again, and it was fixed! Jan 12, 2020 at 2:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .