Home / server / Questions / 284031
In Process
FrancisV
Asked: 2011-06-25 19:02:34 +0800 CST

Exchange 2003 SMTP SSL and various email clients

  • 772

This Exchange 2003 server sits behind a firewall with a virtual SMTP server listening on port 465 and attached an SSL certificate from Comodo to the virtual server. However, when trying to send from Apple Mail.app 4.x and Outlook 2011 for Mac, it never completes the connection (time out). Oddly though, the same setup works with Thunderbird. My question is:

  • Does it matter if the friendly name of the certificate is different from the internal hostname? The machine has 2 hostnames: external and internal. The official SSL is using the external name.
  • When using a self-signed certificate with the same name as the internal, I still can't send from the Mail.app and Exchange clients but I can with Thunderbird.
smtp exchange-2003 ssl apple thunderbird

2 Answers

  1. I believe your problem lies in using a non standard port.

    RFC 4409, RFC 3207, and RFC 2476 may help you.

    Almost all mail routing (at least as much as I've dealt with it) is done on port 25 using TLS over standard SMTP, and the clients probably won't send on another port unless you tell it to.

    There's also some info from this site:

    Port 465 shows up Appendix A of the 1996 non-standard standard The SSL Protocol Version 3.0 as "Simple Mail Transfer Protocol with SSL". Unfortunately, it's not registered for SMTPs, it's registered for URD - "URL Rendesvous Directory for SSM" by Cisco. The recommended approach, at least for authentication, is to use START TLS encryption on submission port 587.

    The link in the above quote is dead, but this one seems to work.

    Another informative forum link here.

    • 2

  2. I changed the port from 465 to 587 and sending worked. I guess what happened was Apple's Mail.app and Microsoft's Outlook 2011 (Mac) clients were trying to connect to port 465 but did not issue a STARTTLS command which the Exchange SMTP server required but when it was switched to 587, the clients somewhat "knew" they had to issue a STARTTLS command.

    • 0