This article applies to:
- MailMarshal (SEG)
- Outbound TLS functionality
Symptoms:
- Message sending failing due to problems with TLS negotiation
- Error message seen after STARTTLS: No available IPv4 route for ...
Causes:
When troubleshooting Outbound TLS issues, consider the following points:
Client Certificate:
If the remote server requests a client certificate but no certificate is available (or you choose not to provide one), then the TLS negotiation will fail.
- When providing a client certificate for Outbound TLS, SEG uses the same certificate installed for Inbound TLS.
- Verify that you have installed a client certificate on each processing server.
- In the Configurator, see Server and Array Configuration > Servers > [specific server] > Inbound Security (TLS).
- In the MailMarshal (SEG) 10.0 and above Management Console see Mail Servers, then select the server from the list at the right and select Inbound Security (TLS).
- To ensure that a certificate is acceptable as a client certificate, purchase it from a Certificate Authority. This allows the receiving server to check the validity and revocation status of the certificate.
- Verify that you are offering the Client Certificate if requested: see MailMarshal SEG Properties > Sender > Outbound Security (TLS).
Cipher Strength:
You can set a minimum cipher strength. If the other server does not have matching abilities, then negotiation may fail.
- Check the configured strength: see System Configuration (or MailMarshal SEG Properties) > Sender > Outbound Security (TLS). Servers with current security posture will support Medium strength. Medium strength generally includes 128-bit ciphers. Low or "insecure compatibility" strength includes older and deprecated ciphers. This selection should only be used if absolutely necessary. Note that it may increase risk because it applies to all connections, even though it is only required for connections to obsolete servers.
TLS Protocol:
Choice of TLS protocol is controlled by the receiving server. By default, the MailMarshal sender will connect using any of TLSv1.0, TLSv1.1, or TLSv1.2.
