SUPPORT AUTOMATION- SERVERCA Service Desk Manager - Unified Self ServiceCA Service Desk ManagerCA Service Management - Asset Portfolio ManagementCA Service Management - Service Desk Manager
Issue/Introduction
I have heard that TLSv1.0 can be considered the same as SSLv3.1. Are there any differences?
I have heard that all SSL versions are broken and insecure due to the POODLE attack. Is Maileater affected?
TLS negotiates the connection with the email server in plain text. Are my login credentials being sent unencrypted?
My email server uses a chain of certificates. Do I need to include the entire chain for maileater to work with TLS?
Environment
CA Service Desk 17.x
Resolution
TLS 1.0 was the successor to SSL 3.0, and the terms SSL and TLS are used somewhat interchangeably. TLS 1.0 is equivalent to SSL 3.1, however TLS is not backwards compatible with SSL 3.0 and earlier.
No. The POODLE (Padding Oracle On Downgraded Legacy Encryption) attack targeted SSL 3.0 and earlier, however proper implementations of the TLS standard check the padding and prevent this attack.
We do not transmit mail server credentials in plain text. We first send a HELLO packet to the mail server over plain connection and then do “STARTTLS” to enhance the protocol to a more secure version. Only if this step succeeds, we do a login call.
Having the Root CA Certificate (in PEM format) should suffice for the certificate validation.