5 ms·

Do email daemons validate certificates now? I thought they didn't - which would make encryption fairly pointless

• Sami_Lehtinen 12y ago
  Of course, if you just enable it. http://www.sami-lehtinen.net/blog/securing-email-transport-starttls-postfix-ca-certificates-fingerprint-authority http://www.sami-lehtinen.net/blog/securing-email-transport-s... Unfortunately even many large providers use invalid (non verifiable) certificates. Unless you of course install their public key locally and verify against it.
  • teekert 12y ago
    Unfortunately? I also use unverified certificates on my own mail server. I don't want to be requesting certificates or signing for every time I set up a mail server. And why does it make encryption pointless? The traffic IS encrypted, server to server. Are you afraid someone hijacked a domain?
    • drdaeman 12y ago
      Because unauthenticated encryption is no good. It only protects communications against passive attackers (mere observers), which, I think, is generally considered to be far from sufficient. Meanwhile, it creates a false sense of security, which isn't a good thing.
• nly 12y ago
  STARTTLS on port 25 is vulnerable to active MITM anyway, so having your certificate signed by a big CA doesn't really get you much. For delivery over port 465 it makes sense, but an active MITM could still block your connection and see if you fall back to STARTTLS on 25. Fastmail have a good summary of the current situation[0]. And, as Sami_Lehtinen said, many servers out there probably have self-signed certs. [0] https://www.fastmail.fm/help/technical/ssltlsstarttls.html https://www.fastmail.fm/help/technical/ssltlsstarttls.html
• brl 12y ago
  Even if you validate certificates an active attacker can return false MX records and direct the sending MTA to connect to an attacker-controlled server which presents a perfectly valid certificate.