SSL/TLS for SMTP on Exchange 2010 but not using STARTTLS

exchange-2010

I am forced to use an old legacy system that apparently is never going away which requires an SSL/TLS connection but then transmits the information through the TLS tunnel plain text. The most common thing I am finding for using TLS with exchange 2010 is to have a plain text connection and then use STARTTLS to begin encryption and send your message encrypted after the original plaintext connection. Can someone help me de-cypher the settings inside exchange 2010's receive connector settings to accomplish this?

Best Answer

Ahh, yes-- the old "SMTPS", or SMTP with implict SSL. Outlook Express was notorious for doing this.

I'm having trouble finding authoritative documentation on this. Per the first question from this old Technet Magazine Q&A article, Exchange 2007 didn't support implict SSL. I can't imagine the functionality was added in Exchange 2010 since it wasn't in any prior version.

Were I in your shoes, I'd grab a copy of stunnel for Windows and configure it to listen for your legacy system's traffic (probably on TCP port 465-- that was the old "SMTPS" port) and proxy it to the SMTP server on the server. You could run it on the Exchange Server computer itself or, if you'd prefer to keep that machine stock, on the legacy system (if it runs an OS that stunnel builds on), or on some other box.

Related Solutions

IMAPSync Migration to Exchange 2010 SP1: Exchange drops connections while checking for existence of folders

Had the same errors here.

By appending the "--reconnectretry2" parameter with a value of 10 it works for me (didn't try any lower values).

That causes imapsync to re-establish the connection to the remote-server when it is being dropped.

Now only some errors for syncing messages with larger attachments remain for me. Didn't figure out exact size-limit yet or where I can adjust it.

I'm using imapsync 1.286, on Ubuntu (syncing from dovecot to exchange 2010 right now.)

Exchange 2010 Hub cannot deliver to Exchange 2007 Hub – “451 5.7.3 Cannot achieve Exchange Server authentication”

Finally tracked down the cause. Our Cisco ASA firewall was to blame.

From http://jamesosw.wordpress.com/2009/12/30/exchange-hub-transport-unable-to-communicate-at-different-active-directory-sites/:

If you happen to be deploying Exchange 2007/Exchange 2010 Server in a multiple sites environment and using a Cisco ASA Firewall as your VPN tunnel, you’ll likely encounter issues below:

Users are only able to send emails within the same Active Directory site

When users attempt to send an email over to the next hop/Active Directory Site, under the Exchange Queue, you’ll see a Retry status: 451 4.4.0 Primary target IP address responded with “451 5.7.3 Cannot achieve Exchange Server authentication” SMTPRelay to remote AD Site

When you attempt to telnet from the Exchange Servers from both site, you’ll get such response from the telnet command: 220*************

The only way to fix this is to use the Commandline Interface (CLI) and type in this command:
telnet YourCiscoManagementIP

device password (default is usually cisco)

en

password (Management password)

no fixup protocol smtp 25

write mem
Remember to run these command all firewalls at each site. Once is done, telnet to the Exchange server with port 25 and you should get a normal response:
 220 ExchangeServerHostName.Domain.com Microsoft ESMTP MAIL Service ready at Day, Date Month Year, Hour:Minute:Seconds +TimeZone

As soon as we did this on the ASA, mail started flowing without hassles.

Best Answer

Related Solutions

IMAPSync Migration to Exchange 2010 SP1: Exchange drops connections while checking for existence of folders

Exchange 2010 Hub cannot deliver to Exchange 2007 Hub – “451 5.7.3 Cannot achieve Exchange Server authentication”

Related Topic