Ticket: Exchange 2007 Disable TLS between HUB (Part 2)

-


Disable TLS (原討論)

Reply:
I would like to disable TLS, as I would like to disable the encryption between Hub Transport server for some reason.

1. What is the best approach if I have three Hub Transport servers?

Mailbox Server A using Hub Transport Server A
Mailbox Server B using Hub Transport Server B
Mailbox Server C using Hub Transport Server C

1. Disable Opportunistic TLS on your Receive Connectors.  Your Receive Connectors don't "require" TLS either way as -RequireTLS is set to $false.  Opportunistic TLS just attempts TLS first and if TLS is not possible, it accepts the mail anyways.

2. Do have have to disable both "Send Connector" and "Receive Connector" on all Hub Transport servers?
2. No, just Receive Connector due to what I said in #1.

3. What about Mailbox Servers, do I have to disable it on all Mailbox servers as well?
3. No, all my flows through Hub Transports and gets delivered right to the mailbox on mailbox servers.

4. Is there any security concern?
4. Of course, you're disabling TLS encryption!

5. Actually the reason I am doing it is because there is a appliance, "riverbed" to save traffic between servers, however, hub transport encrypted all traffic between servers using TLS.  As the result, the appliance cannot decrypt it to save traffic, is there a way to use it with TLS enabled?
5. You need to consult your appliance manufacturer for this.  But keeping Opportunistic TLS on shouldn't cause any issues because as I said, it tries TLS first and then reverts to non-TLS if necessary.

6. If not, is there another way to use it more securely?

The Microsoft Developer Network

 

機會性 TLS   在舊版 Exchange Server 中，必須手動設定 TLS。此外，您必須在執行 Exchange Server 的伺服器上安裝適用於 TLS 的有效憑證。在 Exchange 2007 中，安裝程式會建立自行簽署憑證。預設會啟用 TLS。這可讓任何傳送系統將輸入的簡易郵件傳送通訊協定 (SMTP) 工作階段加密到 Microsoft Exchange 中。依據預設，Exchange 2007 也會針對所有遠端連線嘗試 TLS。

Blog 延伸閱讀

Ticket: Exchange 2007 Disable TLS between HUB (Part 1)


More Information

Comments

Post a Comment

Popular posts from this blog

E15 CU3–Update Failed–AD replicated Exceeded the tombstone lifetime.

-
Image
  Exchange 2013 CU3 The naming context is in the process of being removed or is not replicated http://technet.microsoft.com/en-us/library/replication-error-8452-the-naming-context-is-in-the-process-of-being-removed-or-is-not-replicated-from-the-specified-server(v=ws.10).aspx   C:\> REPADMIN /SHOWREPS Root\RDC01 DSA Options: IS_GC Site Options: (none) DSA object GUID: f1694974-47c4-4555-a214-db3c86854aeb DSA invocationID: f1694974-47c4-4555-a214-db3c86854aeb ==== INBOUND NEIGHBORS ====================================== CN=Schema,CN=Configuration,DC=lab7,DC=root     TW\AD02 via RPC         DSA object GUID: bfcc1053-e1da-46fd-8b9d-179c7992...
Read more

202301 - Exchange onpreme - PowerShell Serialization Payload Signing

-
Image
Released: January 2023 Exchange Server Security Updates https://techcommunity.microsoft.com/t5/exchange-team-blog/released-january-2023-exchange-server-security-updates/ba-p/3711808 https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/SerializedDataSigningCheck/ 1.  Update KB5022143 (Exchange SU) 2. Run latest HealthCherker 3.  PowerShell Serialization Payload Signing https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/SerializedDataSigningCheck/ Certificate signing of PowerShell serialization payload in Exchange Server https://support.microsoft.com/en-us/topic/certificate-signing-of-powershell-serialization-payload-in-exchange-server-90fbf219-b0dd-4b2c-8a68-9d73b3309eb1 4.  MonitorExchangeAuthCertificate    https://microsoft.github.io/CSS-Exchange/Admin/MonitorExchangeAuthCertificate/ 5.                 New-SettingOverride -Name "EnableSigningVerification" -Component Data -Secti...
Read more

Ticket: RemoteAPP certificate revocation check error

-
Image
  . certutil -f –urlfetch -verify <your_certificate>.cer From internet client (Win7 ultimate x64) Issuer:     CN=TWCA Secure CA -Evaluation Only     OU=SSL Certification Service Provider-Evaluation Only     O=TAIWAN-CA INC.     C=TW Subject:     CN=deep2.msft.com     OU=ITS     O=Msft Corporation     L=Taipei     S=Taiwan     C=TW Cert Serial Number: 04bd dwFlags = CA_VERIFY_FLAGS_ALLOW_UNTRUSTED_ROOT (0x1) dwFlags = CA_VERIFY_FLAGS_IGNORE_OFFLINE (0x2) dwFlags = CA_VERIFY_FLAGS_FULL_CHAIN_REVOCATION (0x8) dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000) dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000) ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN (0x20000000) HCCE_LOCAL_MACHINE CERT_CHAIN_POLICY_BASE -------- CERT_CHAIN_CONTEXT -------- ChainContext.dwErrorStatu...
Read more