0

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com is using a TLS certificate issued to mail.protection.outlook.com.

Both the mail server hostname and TLS certificate common name belong to the same subdomain: protection.outlook.com

I'm trying to understand what's happening. Am I expected to ignore this kind of name mismatch?

This report seems to point out that there's something wrong:

hotmail.com TLS report

Edit 2018-08-04

Report link: https://ssl-tools.net/mailservers/hotmail.com

-1

It's currently fixed (2020-01-11), Certificate chain is valid:

mail.protection.outlook.com
128 days remaining / 2048 bit / sha256WithRSAEncryption


GlobalSign Organization Validation CA - SHA256 - G3
2062 days remaining / 2048 bit / sha256WithRSAEncryption


GlobalSign Root CA (Certificate is self-signed.)
2939 days remaining / 2048 bit / sha1WithRSAEncryption

Report:

🙂

-1

It seems that hotmail.com mail server sitting at hotmail-com.olc.protection.outlook.com

How often do you send messages to (mailbox)@hotmail-com.olc.protection.outlook.com?

Where did you get hotmail-com.olc.protection.outlook.com from?

The certificate needs to match the MX record for the domain. When I check:

 $ nslookup
 > set type=MX
 > outlook.com
 Server:         127.0.1.1
 Address:        127.0.1.1#53

 Non-authoritative answer:
 outlook.com     mail exchanger = 5 outlook-com.olc.protection.outlook.com.

Unfortunately Thomas left off the part of the screen shot which explains why the certificate presented there is valid - it is because one of the subject alternate names is *.olc.protection.outlook.com which also matches the address you cited.

enter image description here

  • Back then I was developing a custom Mail Submission Agent and when executing a STARTTLS command against hotmail.com servers (after resolving the domain MX records) the application was failing to validate the provided certificate. Today I remembered about it and decided to check it again, and it was fixed! – Thomas C. G. de Vilhena Jan 12 at 2:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.