Re: Interop problem with SMTP STARTTLS and Cisco PIX firewall

On Wed, 24 Mar 1999, Scott Roberts wrote:
> If the SMTP Server is not configured with a certificate, or it has expired,
> or it is using an invalid certificate the TLS Client will STILL fail during
> the TLS negotiation.

True, but only after wasting network round-trips and resources at both
ends of the connection.

> If the SMTP Server did not advertise STARTTLS, due to
> an invalid or absence of a certificate, the TLS Client might return the
> message to the sender stating that the server does not support TLS even
> though the server was configured to do so.

This depends on the TLS client setting.  In the common case (client
doesn't require TLS encryption), the message will go through normally
without TLS and one or more network round-trips will be saved.  In the
less common case (client requires TLS encryption) the message will be
bounced sooner.

> If the SMTP Server, with no
> certificate, advertised STARTTLS the negotiation would fail but the TLS
> Client would be aware that the server supports TLS and attempt to send the
> message at a later time in hopes that the certificate issue will be
> resolved.

Maybe it's just me, but it seems ludicrous to treat failure to find a
compatible cipher suite as a temporary error when the client is configured
to require TLS.  The only case an SMTP server with no cert should
advertise STARTTLS is if the DH_ANON cipher suite is enabled.

The only case I can see for a temporary error is if the server gets too
busy to spend time doing PKI and responds with a 4xx to the STARTTLS
command.  The a client configured to require TLS should hold the message
until the server is less busy.

> The issue is not with the product itself but with our opinions on
> what is expected by the SMTP server when there is an issue with the
> certificate and if it should advertise STARTTLS or not.

If the server can't successfully negotiate any cipher suites, advertising
STARTTLS is worse than pointless -- it wastes network round-trips.

		- Chris