In RiOS 7.0 or later, you can securely communicate over the internet with Secure Simple Mail Transfer Protocol (SMTPS). This chapter includes the following sections:

SMTP is the standard for email transport across the internet and the standard communication method for Microsoft Exchange hub servers in Exchange 2007 to Exchange 2013. Prior to RiOS 7.0, SMTP or SMTPS was sent through the SteelHead as a pass-through connection. Because the SMTP session was set up prior to the encrypted session, you could not determine when to start SSL traffic optimization.

RiOS 7.0 and later support StartTLS for Transport Layer Security (TLS) and Secure Socket Layer (SSL) to determine the start of an SMTPS connection and the early finish that enables the setup of encrypted (TLS or SSL) connection to terminate without disconnecting the SMTP session. This functionality provides more efficient use of the protocol, because it does not perform a handshake on every email sent using SMTPS.

For more information about SSL, see SSL Deployments. For more information about delayed Start TLS, see Mid-Session SSL Support.

Figure: SMTP Connection shows what happens when the START-TLS command is issued after the initial SMTP connection is established. Prior to RiOS 7.0, there was no way to determine that an encrypted session had started, so traffic optimization results on the port were low. It was common to enter a pass-through rule for this connection to prevent unnecessary use of RiOS resources.

In RiOS 7.0 or later, support for Secure SMTP enables the SteelHead to intercept the START-TLS message after it is issued, which enables the SteelHead to optimize native Secure SMTP traffic.

Figure: Secure SMTP Connection Setup Using TLS shows the setup of an SMTPS session. First, an unencrypted SMTP session is intercepted and optimized through the SteelHead. When the START-TLS is issued, RiOS recognizes that a secure session is imminent and begins the necessary operations to optimize the SSL or TLS session. For more information about SSL optimization, see SSL Deployments.

In RiOS 9.2 and later, TLSv1.2 support is enabled by default. A software update from an earlier RiOS version to 9.2 or later automatically enables TLSv1.2 support. To display TLS configuration status for a client or server, use the CLI command show protocol ssl backend. Use the CLI command show secure-peering for peering interface configuration.

Microsoft Exchange hub servers have additional authentication mechanisms beyond TLS or SSL. Two specific environments require additional configuration on the Exchange hub server to allow the Secure SMTP optimization to function properly:

Configuration with Microsoft Exchange Hub servers requires the following prerequisites:

An Exchange hub server does not allow its private key to be exported. You cannot retrieve either the certificate or the private key from the hub server. For details regarding receive connectors and certificates in an Exchange hub server environment, go to the following websites:

You can generate the new certificates with the tool listed in Microsoft Technote 998327 or with OPENSSL. This is an example with OPENSSL:

After you create the new self-signed certificates, you must install them on the remote and local Exchange server—which runs the hub server role—as defined next.

This section describes how to configure the SteelHead to use START-TLS.