Re: Interop problem with SMTP STARTTLS and Cisco PIX firewall

"Larry Osterman (Exchange)" wrote:
> There is a real issue here - it is totally reasonable to have a client that
> is configured to only talk to an SMTP server that supports STARTTLS, and you
> don't want the client to blindly fail when the server is CAPABLE of
> supporting TLS but currently has a configuration error that causes it to
> prevent TLS negotiation from succeeding.
> 
> I actually think that the right thing to do is to advertise STARTTLS (since
> thats a server capability) and to fail the STARTTLS command with a
> distinguished 4xx error (and of course the server should raise huge alerts
> and warnings).

This is not, however, the case with Exchange 5.5 SP2.  That server
always advertises STARTTLS, even if the server was never configured with
a cert.  It fails the STARTTLS command with a 5xx error.

I consider it entirely reasonable for Chris to describe such an
implementation as "not high quality."  I am pleased to hear that future
versions of Exchange will suppress the STARTTLS extension in this
situation.  I also consider it reasonable to say the STARTTLS document
should provide more guidance in this situation.