This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Mail Encryption when the recipient has a privately signed CA

Hello,

we use Sophos Mail encryption with official certificates for our users everything works fine but only when the recipient (at another company for example) also has official S/MIME certificates.

If the Sophos does not trust the Authorities it will not import the S/MIME Certificate which makes sense for me but what i don´t understand is that it will Download the untrusted CA and save it under "Local S/MIME Authorities" but then still not import the S/MIME Certificate.

I think the sophos Downloads The CA if the certificate has a link embedded to to it like this.

Greating David

This thread was automatically locked due to age.

0 Jaydeep over 4 years ago

Hi rtos

Would you please tell us if you're using Sophos UTM 9 or any other product?

Regards

Jaydeep
Cancel
Vote Up 0 Vote Down

Cancel
0 rtos over 4 years ago in reply to Jaydeep

Hi @Jaydeep

We use UTM 9 Version: 9.605-2

We have two SG230 In Hot Standby mode
Cancel
Vote Up 0 Vote Down

Cancel
0 Jaydeep over 4 years ago in reply to rtos

Hi rtos

Thanks for confirming this. If Sophos does not trust the CA, it will definitely not import S/MIME as you already mentioned. However, Would you confirm if you are seeing this behavior with any untrusted CA with CRL not configured in it?

Regards

Jaydeep
Cancel
Vote Up 0 Vote Down

Cancel
0 rtos over 4 years ago in reply to Jaydeep

Hi, i just checked again.

It will only import the CA´s if th CRL is Configured in the S/MIME Sginature.

What i don´t know does the Sopos automatically trust the CA it gets it from those CRL information's ?

For me it looks like it does from the Web interface, as it lists them under Local S/MIME Authorities and Enables Them by default.

.

But then it wont Import the Corresponding S/MIME Certificates as if the Authorities are not trusted.
Cancel
Vote Up 0 Vote Down

Cancel
0 rtos over 4 years ago in reply to rtos

In the Sophos UTM Manual on Page 403 there i no mentioning of auto import of CAs https://www.sophos.com/de-de/medialibrary/PDFs/documentation/utm9506_manual_eng.ashx
So i think the Sophos is not behaving as it should or am i missing something
Cancel
Vote Up 0 Vote Down

Cancel
0 rtos over 4 years ago in reply to rtos

Update, it probably does not get the CA from the link in the first screen shot which was the revocation list.
I think it downloads the certificate from here:

Then also the Fingerprint in Sophos and the one on this CA are matching
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 4 years ago in reply to rtos

Hallo David and welcome to the UTM Community!

Is the mystery solved?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel