Re: Using TLS to Secure Email

Tech-Archive recommends: Speed Up your PC by fixing your registry

From: Ben Winzenz [Exchange MVP] (ben_winzenz_at_NOSPAMdotmessageonedotcom)
Date: 03/01/05 

Date: Tue, 1 Mar 2005 16:49:18 -0600

All I can say is that not a lot of people actually implement it. I haven't
actually seen anyone that implemented it in the real world, though we've
done a bit of testing with TLS at my current job. At my last job, we did
have to secure communications between a medical company, but we ended up
setting up a point-to-point VPN between us and them and simply routing
e-mail through the VPN tunnel via an SMTP connector and Smart Host settings.
That also worked well, but I suspect it took much more time to set that up
than TLS would have taken as we had to deal with discrepancies between 2
different types of firewalls. TLS, in theory, is very easy to implement.
It is simply SSL for SMTP mail. As such, it just requires a certificate to
be installed on the remote target. If they already have a web server
certificate (such as for OWA), then I'm pretty sure that they can use that
same cert on the SMTP Virtual Server as well. 

-- 
Ben Winzenz
Exchange MVP
"Kevin Bachelder" <kevinbachelder@hotmail.com> wrote in message 
news:OyeZzrpHFHA.3472@TK2MSFTNGP09.phx.gbl...
> Hey Ben,
>
> Thanks very much for the quick reply!
>
> I will be migrating to Exchange 2003 in the next few weeks.  I have posted
> this question on a few Exchange discussion lists but I haven't had anyone
> who actually implemented this respond as of yet.  Is this something you 
> had
> done or seen done "in the real world"?  There doesn't appear to be a lot 
> of
> information about TLS available.
>
> Thanks again,
>
> Kevin
>
> ------------------
>
> Kevin Bachelder
>
>
> "Ben Winzenz [Exchange MVP]" <ben_winzenz@NOSPAMdotmessageonedotcom> wrote
> in message news:udX2JmpHFHA.2156@TK2MSFTNGP09.phx.gbl...
>> Which version of Exchange are you running?
>>
>> Exchange 2000/2003, it should be fairly easy to implement this.  You 
>> would
>> simply create an SMTP Connector for that specific domain (or that list of
>> domains) and specify under the outbound security that it use TLS.  As 
>> long
>> as the remote domains (medical companies) have a public certificate
> attached
>> to their SMTP Server, then it should work just fine.  That puts the cost
> for
>> implementing TLS at about $175 (approx. cost for an SSL cert from 
>> Thawte).
>>
>> -- 
>> Ben Winzenz
>> Exchange MVP
>>
>>
>> "Kevin Bachelder" <kevinbachelder@hotmail.com> wrote in message
>> news:uQFz3gpHFHA.1476@TK2MSFTNGP09.phx.gbl...
>> > Hi all,
>> >
>> > I am the IT manager for a small company and a handful of our clients 
>> > are
>> > medical offices.  I have been looking into server-based solutions to
>> > secure
>> > our email communications in light of the upcoming HIPAA security
> deadline.
>> > Unfortunately, many of the good products (i.e. easy to use) cost 
>> > several
>> > thousand dollars.  I have done some research and it looks like using 
>> > TLS
>> > (Transport Layer Security) between our email server and our recipients'
>> > server would do the trick and would not be that expensive to implement.
>> >
>> > Has anyone else used this approach or care to comment on this idea?
>> >
>> >
>> > Thanks in advance for your time and feedback,
>> >
>> > Kevin Bachelder
>> >
>> > ------------------
>> >
>> > Kevin Bachelder
>> >
>> >
>> >
>>
>>
>
>

Relevant Pages

  • Re: Disable StartTLS on EX2007 Send Connectors
    ... I notice it only occurs when Exchange makes a connection to another server ... You can however change the FQDN on the send connector however to match ... Everytime it hits another server that offers TLS ... Ensure the built-in self cert that Exchange ...
    (microsoft.public.exchange.admin)
  • Re: Receive Connector authentication and Permission
    ... TLS is opportunistic I ... certificates installed (on the Exchange 2003 virtual server and the Exchange ... connector setup incorrectly, as the Exchange 2003 server recieves mail ...
    (microsoft.public.exchange.admin)
  • Re: TLS on exchange 2003
    ... MVP - Exchange ... server as per the KB article in your other reply. ... Correct - just as you're configuring a Connector for outbound mail to their ... get mail without TLS ...
    (microsoft.public.exchange.admin)
  • RE: 802.1x and PEAP
    ... > server authenticating ... > protected by the TLS session or a protected ... The initial identity exchange is used ... > protection, URL filtering, VPN, ...
    (Security-Basics)
  • Re: Using TLS to Secure Email
    ... Exchange 2000/2003, it should be fairly easy to implement this. ... simply create an SMTP Connector for that specific domain (or that list of ... to their SMTP Server, then it should work just fine. ... "Kevin Bachelder" wrote in message ...
    (microsoft.public.exchange.admin)