Configuring the TLS Certificate Name for Exchange Server Receive Connectors
https://practical365.com/configuring-the-tls-certificate-name-for-exchange-server-receive-connectors/
Consider a scenario in which you’re trying to do the right thing by ensuring that authenticated SMTP client connections to your Exchange server are protected by TLS encryption. Most commonly this will be when you have IMAP or POP clients configured with the Exchange server (or a DNS alias that points to the Exchange server) as the SMTP server for sending email.
If the client tries to authenticate over an unencrypted connection, a message is received with words to the effect of:
The outgoing server (SMTP) mail.exchangeserverpro.net does not support the selected authentication method.
After Googling around you learn that your SMTP client should use STARTTLS in order to authenticate securely. Here’s an example of how that is configured in Mozilla Thunderbird’s outgoing server settings.
Notice also the use of port 587. Exchange servers are pre-configured by setup with a receive connector that is designed for use by SMTP clients, named “SERVERNAMEClient Frontend SERVERNAME”. This is the port and connector that you should be using for your authenticated SMTP clients.
When you next attempt to send an email you get a different error. Depending on the email client you may get a certificate trust warning, a prompt to add a security exception to trust the untrusted certificate, or it may just fail completely with a certificate error. In all cases, clearly something is still not right.
The solution here is in the configuration of the receive connector that authenticated SMTP clients will be connecting to. Even though you have enabled a valid SSL certificate for SMTP, the connector needs to be configured with the “TLS certificate name” that you want to use. The first time I ran into this problem I found lots of articles and blog posts telling me that was the solution, but none of them told me how to actually configure that. And if you look at the Set-ReceiveConnector documentation, you still get confusing (and wrong) advice.
The TlsCertificateName parameter specifies the X.509 certificate to use with TLS sessions and secure mail. Valid input for this parameter is [I]Issuer[S]Subject. The Issuer value is found in the certificate’s Issuer field, and the Subject value is found in the certificate’s Subject field. You can find these values by running the Get-ExchangeCertificate cmdlet.
The above would probably be more useful if it provided an example, but more importantly, the “[I]” and “[S]” are not correct. If you try to use them, your Set-ReceiveConnector command will fail.
Here’s an example of using the correct syntax for TlsCertificateName. First, determine the thumbnail value for the certificate you want to use. In this example I’m going to use my wildcard certificate, which is already enabled for SMTP.
[PS] C:\>Get-ExchangeCertificate
Thumbprint Services Subject
---------- -------- -------
4A4B66E94A9195FA3344E34E01E6698C44C0A639 ....... O=Microsoft, OU=Microsoft Monitoring Agent, CN={5B5FCD1B-5085-4...
D8C33B1E0FDFE180920C5CEED0612B95269FA1E7 IP.WS.. CN=EX2016SRV2
31E5D6D7E6BD77FC20FA4F490983C6945631CB6C ....... CN=WMSvc-EX2016SRV2
DE67EC3C8D679AA35D17678FEC51907272B1BAE2 ...WS.. CN=*.exchangeserverpro.net, OU=IT, O=LockLAN Systems Pty Ltd, L...
A49E18338DB7B07E75D46DBF843D919A014F9A63 ....SF. CN=Federation
436C266B30409B25C13A7EC17CBD4E9F5D8DAD79 ....S.. CN=Federation
Next, capture the certificate as a variable.
[PS] C:\>$cert = Get-ExchangeCertificate -Thumbprint DE67EC3C8D679AA35D17678FEC51907272B1BAE2
Now, declare a new variable for the certificate issuer and subject values.
[PS] C:\>$tlscertificatename = "<i>$($cert.Issuer)<s>$($cert.Subject)"
Now we can set the receive connector’s TlsCertificateName property without having to type out a long string containing the issuer and subject values.
[PS] C:\>Set-ReceiveConnector "EX2016SRV1\Client Frontend EX2016SRV1" -TlsCertificateName $tlscertificatename
Repeat that for every server and connector that will be handling the authenticated SMTP connections, i.e. if you’re using a load balanced SMTP namespace.
Your SMTP clients should now be able to securely authenticate without any warnings or errors appearing.
If you’re interested in how Exchange handles selection of a certificate when multiple certificates are bound to the SMTP protocol, here are some articles that explain it:
Комментарии
Отправить комментарий