Enforce SMTP setting troubleshooting with TLS1.3

Products

• Data Loss Prevention

Issue/Introduction

You setup TLS with SMTP settings on Enforce to send emails.

Environment

The SMTP setting is not accepted, resulting in an error. The Wireshark capture shows TLS 1.3 being negotiated. The remote system reports the error: "454 TLS not available due to a temporary reason," which then closes the connection.

Cause

The problem lies with the SMTP server certificate, which is not trusted by Enforce. As a result, Enforce refuses the connection. This can
be misleading when analyzing the Wireshark capture, as TLS 1.3 does not reveal many details during the SSL handshake. However, if we
force the use of TLS 1.2, we can observe in the Wireshark capture that Enforce sends an "untrusted certificate" message:

 

Resolution

Import the SMTP server's certificate, or the root/intermediate CA certificates which issued the SMTP server's end certificate, into the cacerts keystore of the Enforce server:

Importing SSL Certificates to the Enforce Server or Detection Servers.