Specify the Protocol Versions to use with TLS

This article applies to:

• Trustwave SEG (MailMarshal) version 7.3 and above
• MailMarshal (SEG) 10.X adds TLSv1.3
• For configuration in SEG 10.0.1 and above, see article Q21147
  • In 10.0.0, the protocols cannot be configured; the default values are always used

Question:

• How can I specify the acceptable protocol versions for use with TLS?

Procedure:

TLS or Transport Layer Security is a method of creating a secure connection between servers over which email can be transported.

Note: For basic information about using TLS with Trustwave SEG, see Q11636: How Do I Set Up TLS in Trustwave SEG?

SEG can use any of the following protocol versions when establishing a TLS connection:

• TLSv1.3 (added at version 10.0)
• TLSv1.2
• TLSv1.1
• TLSv1.0
• SSLv3
• SSLv2

By default for new installations or upgrades to version 7.3.5 and above, when receiving or sending email, MailMarshal accepts TLSv1.0 and later (NOT SSLv3 or SSLv2).

• Note that on upgrade to 7.3.5, SSLv3 IS DISABLED. You can re-enable this version, if absolutely necessary, as described below.

By default for new installations of version 7.3, when receiving or sending email, MailMarshal accepts SSLv3 and later (NOT SSLv2).

Receiver

TLS settings are controlled by the receiving server.

• The default option balances compatibility with security (SSLv3 and SSLv2 are deprecated and do not meet current security standards such as PCI DSS).
  • To use SSLv2 with SEG 7.3 and above, you must install a client certificate. (This requirement is due to a behavior of the TLS/SSL library.)
• If you specify an option that the sending server does not support, the TLS negotiation can fail. In some cases, you could be unable to receive email from a domain.

You can specify the protocol versions that SEG will accept when receiving email. You can select this option separately for each server in an array.

Note: You can use rules to take further action on individual messages, based on the TLS protocol version actually used.

To specify the protocol:

1. On the Array Manager, edit the Registry (setting not available in 10.0.0)
   • For 10.0.1 and above, see article Q21147.
   • For full details of the location for each product version, see article Q10832.
2. To set the value for a specific server, navigate to the appropriate key as described:
   • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Servers\<servername>
     for example …\Default\Servers\MyServer
3. Add one or more of the following DWORD values and set the value data to 1 (enable) or 0 (disable).
   • SSLMethodSSLv2
     • Default: 0
   • SSLMethodSSLv3
     • Default: 0 in 7.3.5 and above; default: 1 in 7.3.0
   • SSLMethodTLSv1.0 
     • Default: 1
   • SSLMethodTLSv1.1
     • Default: 1
   • SSLMethodTLSv1.2
     • Default: 1
4. Repeat the above steps for each server that uses TLS.
5. To apply the Registry changes to the email processing servers:
   • Commit configuration changes
   • Restart the Receiver service on each email processing server.

Sender

When SEG sends email using TLS, the protocol used depends on the settings of the other server. However you can specify the protocols that will be advertised for negotiation by the Sender. This option applies to ALL servers in an array and cannot be set separately for each server.

To specify the protocol:

1. On the Array Manager, edit the Registry (setting not available in 10.X)
   • For 10.0.1 and above, see article Q21147.
   • For full details of the location for each product version, see article Q10832.
2. To set the value for all servers, navigate to the appropriate key as described:
   • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Sender
3. Add one or more of the following DWORD values and set the value data to 1 (enable) or 0 (disable).
   • SSLMethodSSLv2
     • Default: 0
   • SSLMethodSSLv3
     • Default: 0 in 7.3.5 and above; default: 1 in 7.3.0 
   • SSLMethodTLSv1.0 
     • Default: 1
   • SSLMethodTLSv1.1
     • Default: 1
   • SSLMethodTLSv1.2
     • Default: 1
4. To apply the Registry changes to the email processing servers:
   • Commit configuration changes
   • Restart the Sender service on each email processing server.

Notes:

Warning: Using the Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Trustwave cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Make sure that you back up your Registry prior to making any changes. 

Upgrading

• Earlier versions of SEG (MailMarshal) used a different method for registry entry. See article Q11675. On upgrade, settings will be updated to use the new registry entries.
• In 7.3.X, the default Receiver setting will be changed to the new default (7.3.5: TLSv1.0 and above enabled; 7.3.0: SSLv2 disabled), with the following exceptions:
  • If TLSv1 was explicitly set as the only version enabled, TLS v1.0, TLSv1.1 and TLSv1.2 will be enabled.
  • If SSLv2 was explicitly set as the only version enabled, it will remain enabled. However, SSLv2 is deprecated and considered insecure, so you should change this setting as soon as possible. To use SSLv2 with SEG 7.3 and above, you must install a client certificate.
• In 7.3.0, the default Sender setting will be changed to the new default (all versions enabled EXCEPT SSLv2), unless the registry entry UseTLSv1 was set. If this entry was set, then SSLv3 will also be disabled; TLS v1.0, TLSv1.1 and TLSv1.2 will be enabled.
• In 7.3.5, the default Sender setting will be changed to the new default (TLSv1.0 and above).