re: How to Verify MS Online TLS Message Delivery

joshmaher — Wed, 05 Nov 2008 08:19:45 GMT

This is great that TLS will be supported.

I am curious though, why won't the MTLS features take effect if a customer has Exchange 2007 on-site?

Also for those customer's who want to have private certificates, is there anything on the roadmap to allow private certs between the on-site email system and Exchange Online?

re: How To Verify Microsoft Online Services Transport Layer Security (TLS) E-mail Delivery

Ryan J. Phillips — Mon, 24 Nov 2008 23:50:27 GMT

Hi Josh, EHS does not require a client (sending server) certificate, so we wouldn't do MTLS. EHS provides it's certificate, which is a commonly used certificate, which is trusted by ALL Windows machines. As a result, the sending server is able to successfully able to establish a TLS connection and deliver the message.

When EHS attempts to deliver a message to an On-Premise Messaging server (Coexistence), it will attempt a TLS connection and if enabled on the receiving server AND is using a certificate that can be validated (Not expired, on a CRL and the Common Name matches), then EHS will deliver using TLS.

So that end, private certificates cannot be used when receiving mail from an EHS endpoint over TLS.

I hope this helps

....Ryan