Re: Interop problem with SMTP STARTTLS and Cisco PIX firewall

+----- On Thu, 25 Mar 1999 14:40:48 PST, "Larry Osterman (Exchange)" writes:
| I think that Scott has a valid point (and not just because he works for the
| same people as I do, anyone who knows me knows I often disagree with people
| I work with)...
| 
| There is a real issue here - it is totally reasonable to have a client that
| is configured to only talk to an SMTP server that supports STARTTLS, and you
| don't want the client to blindly fail when the server is CAPABLE of
| supporting TLS but currently has a configuration error that causes it to
| prevent TLS negotiation from succeeding.
| 
| I actually think that the right thing to do is to advertise STARTTLS (since
| thats a server capability) and to fail the STARTTLS command with a
| distinguished 4xx error (and of course the server should raise huge alerts
| and warnings).

As I see it the real question is whether the mail can be sent within a 
reasonable amount of time. If a server has had a working TLS 
configuration that doesn't work just now then it should advertise 
STARTTLS but if it has never been configured then it shouldn't. Five 
days seems to be a common queue return time and so I suggest that if a 
valid configuration has not existed in the last five days then it can be 
deemed to have never existed.

/Michael