Specify the Protocol Versions to use with TLS

This article applies to:

• Trustwave SEG (MailMarshal) 8.X
• MailMarshal (SEG) 10.X adds TLSv1.3
• For configuration in SEG 10.0.1 and above, see article Q21147
  • In 10.0.0, the protocols cannot be configured; the default values are always used

Question:

• How can I specify the acceptable protocol versions for use with TLS?

Procedure:

TLS or Transport Layer Security is a method of creating a secure connection between servers over which email can be transported.

Note: For basic information about using TLS with Trustwave MailMarshal/SEG, see Q11636: How Do I Set Up TLS in Trustwave SEG?

SEG can use any of the following protocol versions when establishing a TLS connection:

• TLSv1.3 (added at version 10.0)
• TLSv1.2
• TLSv1.1
• TLSv1.0
• SSLv3
• SSLv2

By default for new installations or upgrades to current versions, when receiving or sending email, MailMarshal accepts TLSv1.0 and later (NOT SSLv3 or SSLv2).

Receiver

TLS settings are controlled by the receiving server.

• The default option balances compatibility with security (SSLv3 and SSLv2 are deprecated and do not meet current security standards such as PCI DSS).
  • To use SSLv2, you must install a client certificate. (This requirement is due to a behavior of the TLS/SSL library.)
• If you specify an option that the sending server does not support, the TLS negotiation can fail. In some cases, you could be unable to receive email from a domain.

You can specify the protocol versions that SEG will accept when receiving email. You can select this option separately for each server in an array.

Note: You can use rules to take further action on individual messages, based on the TLS protocol version actually used.

To specify the protocol:

1. On the Array Manager (8.X), edit the Registry.
   • For 10.0.1 and above, see article Q21147. (The setting is not available in 10.0.0)
   • For full details of the location for each product version, see article Q10832.
2. To set the value for a specific server, navigate to the appropriate key as described:
   • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Servers\<servername>
     for example …\Default\Servers\MyServer
3. Add one or more of the following DWORD values and set the value data to 1 (enable) or 0 (disable).
   • SSLMethodSSLv2
     • Default: 0
   • SSLMethodSSLv3
     • Default: 0 
   • SSLMethodTLSv1.0 
     • Default: 1
   • SSLMethodTLSv1.1
     • Default: 1
   • SSLMethodTLSv1.2
     • Default: 1
4. Repeat the above steps for each server that uses TLS.
5. To apply the Registry changes to the email processing servers:
   • Commit configuration changes
   • Restart the Receiver service on each email processing server.

Sender

When SEG sends email using TLS, the protocol used depends on the settings of the other server. However you can specify the protocols that will be advertised for negotiation by the Sender. This option applies to ALL servers in an array and cannot be set separately for each server.

To specify the protocol:

1. On the Array Manager (8.X), edit the Registry.
   • For 10.0.1 and above, see article Q21147. (The setting is not available in 10.0.0).
   • For full details of the location for each product version, see article Q10832.
2. To set the value for all servers, navigate to the appropriate key as described:
   • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Sender
3. Add one or more of the following DWORD values and set the value data to 1 (enable) or 0 (disable).
   • SSLMethodSSLv2
     • Default: 0
   • SSLMethodSSLv3
     • Default: 0 
   • SSLMethodTLSv1.0 
     • Default: 1
   • SSLMethodTLSv1.1
     • Default: 1
   • SSLMethodTLSv1.2
     • Default: 1
4. To apply the Registry changes to the email processing servers:
   • Commit configuration changes
   • Restart the Sender service on each email processing server.

Notes:

Warning: Using the Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Trustwave cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Make sure that you back up your Registry prior to making any changes.