Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 12 replies
  • Subscribers 2 subscribers
  • Views 39798 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

mails rejected "server certificate not trusted" (dnssec behind utm)

Mike Bruderer

Hope someone with some expertise can jump in:

I have a personal mail server behind an UTM 9 Home (Firmware 9.413-4) and just enabled E-Mail Protection on the UTM (Bridge Mode - works fine). While Email filtering etc. is working extremely good (Spam is blocked, SMTP Logs looks fine etc.), some certificate chain seems to be broken. some third party mail servers do not deliver incoming AND outgoing mails with the error on BOTH sides:

Server certificate not trusted / Diagnostic-Code: X-Postfix; Server certificate not trusted

The mail server handles all the certificates and even DNSSEC is implemented. The setup of the mail server itself is fine and it worked before deployed of the UTM. Having said that, the mail server tests do actually show (after deployment) an error (e.g. on https://de.ssl-tools.net/mailservers/; "unknown authority" as self signed cert is on UTM). It seems to check now the UTM internal TLS cert, and not anymore the original one directly on the mails server. While this makes in some way sense (as UTM is acting as a "MiM") i need to get rid of this problem, as a whole bunch of mails do not get delivered or received. My settings in E-Mail Protection -> SMTP are:

- Simple Mode

- Routing Tab: Domain: mydomain.xy / Route by: Static Host / Host List: (internal) IP of mail server / Recipient Verification: With callout

- Relaying Tab: Upstream Hosts/Networks: (internal) IP of mail server / Allowed Hosts/Networks: (internal) / Scan relayed (outgoing) messages: checked

- Advanced Tab: Use transparent mode: checked / TLS Settings: Local Cert (selected) / Advanced Settings: SMTP Hostname: mydomain.xy BATV: unset etc. / Smarthost Settings: (no smarthost)

Is it maybe possible to use E-Mail Protection without using a certificate on UTM? Means: Can i deploy UTM Mail Protection without relying on UTM certs?

Anyone can jump in here? Thx!



This thread was automatically locked due to age.
Parents
  • 0

    Update: It seems that the DANE authentication request is not put through UTM to the mail server behind; zone informations such as _443._tcp.mail.mailserver.com or 25._tcp.mail.mailserver.com can not be received from the mail server in order that the clients can validate the certificates when DNSSEC is enabled. It "stops" somewhere at the UTM and communicates the UTM internal self-signed certs. External clients or mail services do x-check those values and sometimes deny the communication. How can this be avoided? In short: how can UTM do its Email-Protection while in front of a fully set up and working mail server with DNSSEC enabled on itself? 

  • 0 in reply to Mike Bruderer

    There is a known issue that the utm certificate published for userportal and webadmin does not include the intermediate certificate.  There is one complicated remedy for this problem, posted elsewhere in this forum, but probably unknown to most Sophos support staff.  I am inferring that you have a commercial certificate, and that your certificate chain needs to be correct.

    I also asume that the smtp proxy uses the same certificate as webportal and will have the same chain problem.   This may or may not be your problem as I dont know how DNSSEC fits into all this.

Reply
  • 0 in reply to Mike Bruderer

    There is a known issue that the utm certificate published for userportal and webadmin does not include the intermediate certificate.  There is one complicated remedy for this problem, posted elsewhere in this forum, but probably unknown to most Sophos support staff.  I am inferring that you have a commercial certificate, and that your certificate chain needs to be correct.

    I also asume that the smtp proxy uses the same certificate as webportal and will have the same chain problem.   This may or may not be your problem as I dont know how DNSSEC fits into all this.

Children
No Data
Unfiltered HTML