TLS NEGOTATION FAILED FOR EMAILS SENT FROM GMAIL TO EXCHANGE 2013

Steve Wagner
Steve Wagner used Ask the Experts™
on
My Exchange server is not receiving emails from GMAIL. I ran a checktls report for receiving emails and the gmail sender gets an error- "TLS Negotiation failed: generic::failed_precondition: starttls error (0): protocol error"
A test on checktls fails with errors:
-Cannot convert to SSL (reason: SSL connect attempt failed)
-Cannot proof email address (reason: MAIL FROM rejected)
I removed the IP Blacklist providers, and antivirus and that did not help.
Just not sure how to troubleshoot further and resolve.
I use a wildcard certificate in Exchange could that be the issue?
Help will be appreciated.
Steve
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
David FavorFractional CTO
Distinguished Expert 2018

Commented:
Looks like you may have forced TLS on your incoming MTA (Exchange) + it's somehow misconfigured.

Change your TLS setting to preferred rather than forced TLS. This will let you receive email while you debug the problem.

You can use the openssl command line tool to test + debug your connection.

The openssl command line tool gives correct answers to problems, so there's zero guessing about the real problem.

Author

Commented:
Thanks David,
As soon as I remove the TLS Authentication from the Default Frontend Receive Connector the Gmails come in.
David,
I resolved the issue by reapplying the SSL certificate to the Default Frontend Receive Connector on my server using the following Exchange powershell commands:

Get-ExchangeCertificate    (to identify the SSL certificate thumbprint)

$cert = Get-ExchangeCertificate -Thumbprint 6118939F03CDF30147BBC708C8EECC1CCDB02A26  (my certificate thumbrint)

$tlscertificatename = "<i>$($cert.Issuer)<s>$($cert.Subject)"

Set-ReceiveConnector "EX2013\Default Frontend EX2013" -TlsCertificateName $tlscertificatename

I then re-enable TLS authentication on this receive connector and restarted the MSExchangeFrontEndTransport service.

Thanks
Steve

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial