Re: Configuring SSL in IIS SMTP

I appreciate all that info, Sanford. Thanks!

I've been playing around with different combinations of things today,
but not much success. I thought perhaps that the problem was the lack
of the Verisign intermediate cert that is now required when using
their certs, but I loaded that into the computer account's
Intermediate cert store, and it made no difference (I actually think
the server guys had already loaded that).

The one combination of things I did get to work was having TLS on
Authentication and Require Secure Channel on the Communications button
both checked, and then using a Forte Agent 4.2 client with the option
set to "Use TLS, and fail if not available".

Stupid question: Does this rule out any problems with the cert, or
does TLS not use the cert at all? I really get confused about TLS vs.
SSL since TLS is SSL 3.0, isn't it?

I tried using ports 465 and 443 instead of the one I'd chosen, but it
didn't matter. Any client set to "use SSL" to talk to this server gave
an error that it could not negotiate an SSL connection.

FWIW, the capabilities it gives me to EHLO are shown below, and I
verify that it expects to start TLS.

Any additional advice would be great. I've been setting up mail
servers for 15 years, but never struggled with this stuff before. I'm
sure this is going to turn out to be a misunderstanding on my part of
the difference betwee TLS/SSL as used on the server, and "Use SSL" in
the terminology of the clients. The Forte Agent help so much as says
to try the "Use SSL" and "Use TLS" settings until you figure out which
is the one that works.

EHLO
250-xxx.xx.xx.xx Hello [yy.zz.qqq.sss]
250-TURN
250-SIZE 10485760
250-ETRN
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-8bitmime
250-BINARYMIME
250-CHUNKING
250-VRFY
250-TLS
250-STARTTLS
250 OK
MAIL FROM:<a@xxx>
530 5.7.0 Must issue a STARTTLS command first
.

Loading