Sophos Central E-Mail - S/MIME signed emails are getting invalid

Hey Folks,

we are evaluating Sophos Central E-Mail and experiencing issues with incoming S/MIME signed e-Mails. The Signature is getting invalid, and our security appliance cannot validate the signature/certificate anymore. E-Mails not routet via E-Mail Central from same sender, dont have any issues.

We already created an exception in data control (forward incoming signed e-mails to new gateway) which always applies successfully, but there is still something happening or getting changed on the email.

Are there any issues known with signed e-mails? Or what else can we do?

Thx a lot in advance.

Regards

Peter

Edited tags
[edited by: Raphael Alganes at 2:28 AM (GMT -7) on 30 Jun 2023]

0 emmosophos 3 months ago

Hello Peter,

Thank you for contacting the Sophos Community.

Have you reached out to your Sales Engineer about this? Usually, they’ll assist you during the testing/implementation phase or PoC.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Peter Riederer 3 months ago in reply to emmosophos

yes we did, but nevertheless we ordered the licenses now and i think it doesnt matter if its an evaluation or live use case.

there was a known issue XGE-15978 but there is no update found if this problem is solved now
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Simon Brunner 1 month ago

Did you get any new information on this?

We got the same problem with Sophos Central E-Mail.

Regards

Simon
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Peter Riederer 1 month ago in reply to Simon Brunner

not really, turning circles with support for almost 4 weeks now.

do you use smartbanners? we have the problem, some signed emails are getting applied with smarbanner, hence signature invalid, some emails are not and the signature is valid. (same sender) other senders, do always have an invalid signature e.g. dhl shipping notifications. we also tried to disable the smartbanner feature, but this doesnt change everything.

imho, there are problems with the recognition of signed emails in sophos backend
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuNie 1 month ago

Same problem at our end with enabled Smart Banners and Time-of-Click Protection. Will probably always be the case as soon as Sophos changes anything in the content of the email. It could be possible that the last mile to the email client has to be re-signed. Just like the firewall does with SSL connections.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Peter Riederer 1 month ago in reply to LuNie

Time-Of-Click Protection is a good point, as well. Didnt thought about that.

nevertheless, i dont get it why there are some emails which are valid and neither smartbanners and TOC-Protection are applied, and others not. Sophos just needs to apply a rule in the backend, that signed emails will never get touched and stay unchanged. i dont want to create an exception again for senders which send signed emails.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Peter Riederer 1 month ago in reply to LuNie

there is an option for disabling the rewriting - totally overseen this:

There should be an additional info that securely signed messages will get altered and getting an invalid signature.

This Option should be available for SmartBanners too.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Peter Geiger 12 days ago

Hi,

we have the same problem with smart banners and Time-of-Click Protection enabled...

Peter
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel