This article applies to:
- Trustwave MailMarshal (SEG)
- Transport Layer Security (TLS) functionality
Question:
- What type of certificate should I use for TLS?
- Do I need a self signed certificate or a CA signed certificate for TLS?
Reply:
Use of signed certificates is increasingly common.
To determine the type of TLS certificate required, understand why you are using TLS.
- If the goal is to encrypt messages that are coming into your environment (to prevent casual eavesdropping) then a self-signed certificate is adequate.
- You can use the MailMarshal TLS Certificate Wizard to create a self-signed certificate. When creating a self-signed certificate, the identifying information you enter in the wizard is not critical (the values will not affect the encryption of messages). You may want to select a longer key length to enhance security. The Common Name should be the external DNS name of the server if possible.
- If the goal is not only encryption, but also public authentication or validation of the server, then you will need a certificate signed by a Certificate Authority (CA). You can use the MailMarshal TLS Certificate Wizard to create a certificate signing request to send to a certificate authority (such as Verisign)
- For more advice on values to enter when creating this request please see Q14516 (What information do I enter in TLS wizard when I am creating a certificate signing request to send to a certificate authority?)