Specify the Protocol Versions to use with TLS in MailMarshal (SEG) 10.X

This article applies to:

• Trustwave MailMarshal (SEG) version 10.0.1 and above
• Protocols cannot be configured in MailMarshal (SEG) 10.0.0; the default values are always used
• For SEG 7.X and 8.X, see Trustwave Knowledgebase article Q19541

Question:

• How can I specify the acceptable protocol versions for use with TLS in MailMarshal (SEG) 10.X?

Procedure:

TLS or Transport Layer Security is a method of creating a secure connection between servers over which email can be transported.

Note: For basic information about using TLS with MailMarshal, see Q11636: How Do I Set Up TLS in MailMarshal (SEG)?

SEG can use any of the following protocol versions when establishing a TLS connection:

• TLSv1.3 (added at version 10.0)
• TLSv1.2
• TLSv1.1
• TLSv1.0
• SSLv3
• SSLv2

By default MailMarshal (SEG) 10.X uses and accepts TLSv1.0 and later (NOT SSLv3 or SSLv2).

Receiver

TLS settings are controlled by the receiving server.

• The default option balances compatibility with security (SSLv3 and SSLv2 are deprecated and do not meet current security standards such as PCI DSS).
  • To use SSLv2, you must install a client certificate. (This requirement is due to a behavior of the TLS/SSL library.)
• If you specify an option that the sending server does not support, the TLS negotiation can fail. In some cases, you could be unable to receive email from a domain.

You can specify the protocol versions that SEG will accept when receiving email. You can select this option separately for each server in an array.

Note: You can use rules to take further action on individual messages, based on the TLS protocol version actually used.

To specify the protocol:

1. In the Management Console, navigate to Advanced Settings.
2. To set the value for a specific server, add values prefixed with Servers.<servername>.
   • For example to configure TLSv1.0 for the server named MyServer the value is Servers.MyServer.SSLMethodTLSv1_0
3. Add one or more of the following Integer values and set the value data to 1 (enable) or 0 (disable).
   NOTE: Some value names differ from names used in 8.X and below (using underscore instead of decimal).
   • SSLMethodSSLv2
     • Default: 0
   • SSLMethodSSLv3
     • Default: 0 
   • SSLMethodTLSv1_0
     • Default: 1
   • SSLMethodTLSv1_1
     • Default: 1
   • SSLMethodTLSv1_2
     • Default: 1
     SSLMethodTLSv1_3
     • Default: 1
4. Repeat the above steps for each server that uses TLS.
5. To apply the Registry changes to the email processing servers:
   • Commit configuration changes
   • Restart the Receiver service on each email processing server.

Sender

When SEG sends email using TLS, the protocol used depends on the settings of the other server. However you can specify the protocols that will be advertised for negotiation by the Sender. This option applies to ALL servers in an array and cannot be set separately for each server.

To specify the protocol:

1. In the Management Console, navigate to Advanced Settings.
2. To set the value for all servers, add one or more of the following Integer values and set the value data to 1 (enable) or 0 (disable).
   NOTE: Some value names differ from names used in 8.X and below (using underscore instead of decimal).
• Sender.SSLMethodSSLv2
  • Default: 0
• Sender.SSLMethodSSLv3
  • Default: 0 
• Sender.SSLMethodTLSv1_0
  • Default: 1
• Sender.SSLMethodTLSv1_1
  • Default: 1
• Sender.SSLMethodTLSv1_2
  • Default: 1
• Sender.SSLMethodTLSv1_3
  • Default: 1
3. To apply the Registry changes to the email processing servers:
   • Commit configuration changes
   • Restart the Sender service on each email processing server.

Notes:

• Earlier versions of SEG (MailMarshal) used Registry entries. See Trustwave Knowledgebase article Q19541.
• On upgrade, the settings are copied into the new configuration format. Some copied settings may not appear in Advanced Settings, but all settings are applied correctly and can be changed in Advanced Settings.