SSL Certificate for an email server

Question

I am completely new to SSL/TLS and would appreciate any help you guys could give me.

To give you some background info, our company website is hosted externally by our ISP, however our email is redirected by our ISP to a mail server which is located at our offices.

We use communigate pro.

We have a customer who until recently had no problems in sending us emails, however, we now have a situation whereby their mail server is stopping emails being sent to us.

I believe the root cause of the problem is that when SSL is enabled, the customer's mail server recognises this and so attempts to send email using TLS encryption. However, the SSL certificate used by our mail server is self-signed and, as a consequence, is rejected by the customer's mail server.

The error message returned to our customers is:

    (Certificate rejected over TLS. (sslv3 alert unexpected message))

If SSL is disabled on our mail exchange server, we can receive emails from our customer.

I have acquired a Free Trial SSL certificate issued by comodo, however, it appears that this is still causing a problem. The Certificate is generated for ourdomain.com.

Should this be something like mail.ourdomain.com or should we purchase a wildcard SSL Certificate? I apologise if I have not worded this very well but any advice or other suggestions would be greatly appreciated.

Thanks

Answer 1

It has to be the FQDN of your mail server. This would be what your DNS MX records point to, e.g. mx.mydomain.com.

A mail client will find to which system it needs to send an email based on the mx record associated to the domain of an email address, e.g.

john@test.com: what's the MX record of test.com? mx.mailserver.com

Then and only then will TLS enter the picture. It will connect to mx.mailserver.com and validate it is really talking to mx.mailserver.com via a signed TLS certificate.

Answer 2

There was a question about this on ServerFault. The answer over there was roughly "It's up to the client what they choose to accept."

Some clients don't care about the common name at all. It seems that your customer's client does care.

They also say that the MX record is the most likely value for the common name on the certificate, however since it is normal to have more than one MX record, you will need one of:

1. A certificate for each mail server.
2. A UC certificate (also called a SAN certificate)
3. A wildcard certificate.

Answer 3

thanks for the tips. The MX record was pointing at mail.mydomain.com, updating the certificate sorted that out. We still have a problem as our mail server is desparately out of date and doesn't support TLS 1.1 (or higher), so we'll need to upgrade that now (oh joy!!).

Thanks again for your help.