TLS connection on Mail server

Posted on 2016-09-13
Last Modified: 2016-09-14
For mail server to establish TLS, do I need to install a certfiicate on the server ?

Question by:AXISHK
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Expert Comment

by:Ned Ramsay
ID: 41797190
Unfortunately yes.
You can use an Internal Windows CA but only if you have one setup in active directory.

Author Comment

ID: 41797195
Can i generate a self certficate in the server for this purpose ?

LVL 16

Expert Comment

by:Todd Nelson
ID: 41797262
Yes, you need a certificate for TLS.  If you are using for something like Office 365 it cannot be a self signed certificate.
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Author Comment

ID: 41797266
We own our Exchange 2010. If I use the self certificate, will TLS be established with other side ?


Assisted Solution

by:Ned Ramsay
Ned Ramsay earned 200 total points
ID: 41797287
It will work for connecting through TLS from your client workstations/phones etc.

TLS to another mail server no. The receiving mailserver has no way of knowing if it is genuine if you dont have a recognized CA cert.

I had to do something like this recently to encrypt legal data between two companies.

Author Comment

ID: 41797299
can Exchange use other connection for mail transmission in case TLS can't be established ?

Can you share how to setup the TLS on the Exchange ?

LVL 63

Accepted Solution

Simon Butler (Sembee) earned 300 total points
ID: 41798832
Exchange does Opportunist TLS - so it will fall back to plain SMTP if TLS cannot be done. There is nothing to setup to do that.
You only need to change the configuration if you want to use Mutual TLS (basically use TLS or drop the connection).

Do you not have a trusted SSL certificate on Exchange already? It is pretty much mandatory for Exchange to have a trusted SSL certificate if you have external clients. The self signed certificates are not supported for use with Outlook Anywhere and ActiveSync.

When you can get a suitable certificate for less than $60, trying to get a self signed certificate to work is a false economy.

Author Closing Comment

ID: 41799017

Featured Post

Get HTML5 Certified

Want to be a web developer? You'll need to know HTML. Prepare for HTML5 certification by enrolling in July's Course of the Month! It's free for Premium Members, Team Accounts, and Qualified Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Unified and professional email signatures help maintain a consistent company brand image to the outside world. This article shows how to create an email signature in Exchange Server 2010 using a transport rule and how to overcome native limitations …
A couple of months ago we ran into an issue that necessitated re-creating our Edge Subscriptions. However, when we attempted to execute the command: New-EdgeSubscription -filename C:\NewEdgeSub_01.xml we received an error indicating that the LDAP se…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses
Course of the Month5 days, 16 hours left to enroll

626 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question