3 ms·
> Sprinkle a little Let's Encrypt in there to cover SSL. Unfortunately most MTAs aren't configured to check the certificate chain, so they'll happily take any
by dingaling 9y ago
> Sprinkle a little Let's Encrypt in there to cover SSL.
Unfortunately most MTAs aren't configured to check the certificate chain, so they'll happily take any SSL cert they're handed and start chatting. MITM or downgrading is trivial.
There is an IETF draft ( MTA-STS ) from 2017 that should address this.
- twothamendment 9y agoTrue and it will be nice when MTA's check the chain - but all of my mail clients do check or at least complain if it expires.