This article applies to:

• Trustwave MailMarshal (SEG)
• Outbound TLS functionality

Symptoms:

• Message sending failing due to problems with TLS negotiation
• Error message seen after STARTTLS: No available IPv4 route for ...

Causes:

When troubleshooting Outbound TLS issues, consider the following points:

Client Certificate:

If the remote server requests a client certificate but no certificate is available (or you choose not to provide one), then the TLS negotiation will fail. 

• When providing a client certificate for Outbound TLS, SEG uses the same certificate installed for Inbound TLS.
• Verify that you have installed a client certificate on each processing server.
  • In the Configurator, see Server and Array Configuration > Servers > [specific server] > Inbound Security (TLS).
  • In the MailMarshal (SEG) 10.X Management Console see Mail Servers, then select the server from the list at the right and select Inbound Security (TLS).
• To ensure that a certificate is acceptable as a client certificate, purchase it from a Certificate Authority. This allows the receiving server to check the validity and revocation status of the certificate.
• Verify that you are offering the Client Certificate if requested: see Trustwave SEG Properties > Sender  > Outbound Security (TLS).

Cipher Strength:

You can set a minimum cipher strength. If the other server does not have matching abilities, then negotiation may fail.

• Check the configured strength: see System Configuration (or Trustwave SEG Properties) > Sender  > Outbound Security (TLS). Servers with current security posture will support Medium strength. Medium strength generally includes 128-bit ciphers. Low or "insecure compatibility" strength includes older and deprecated ciphers. This selection should only be used if absolutely necessary. Note that it may increase risk because it applies to all connections, even though it is only required for connections to obsolete servers.

TLS Protocol:

Choice of TLS protocol is controlled by the receiving server.

• In SEG 7.3.5 and above, by default, the SEG sender will connect using any of TLSv1.0, TLSv1.1, or TLSv1.2.   (From 7.3.5, support for SSLv3 is removed by default as per best practices.)
• In SEG 7.3.0, by default, the SEG sender will connect using any of SSLv3, TLSv1.0, TLSv1.1, or TLSv1.2.
  • In 7.3.0 and above versions, you can specify the protocols advertised by the sender (see article Q19541). If you encounter problems with TLS connections, check this setting, and if necessary adjust the selection.
• In SEG 7.2.3 and below, by default, the SEG sender will connect using any of SSLv2, SSLv3, or TLSv1.0.
  • In these versions, you can force SEG to send using only TLSv1, using a Registry entry (see article Q11675). If you encounter problems with TLS connections, check this setting. If necessary revert to connect with any supported protocol.