SFOS 17.5.4 MR-4-1 MTA Mode GMail says no route to host but grey listing is off. Reports from some clients says that there is an error with the TLS encryption. StartTLS rejected

After 2 hours on the phone with Sophos support we found out that the original TLS certificate / Key pair had a password as is best practices but the password didn't seem to be saved anywhere that the SMTPD engine could use. Ended up using OpenSSL to remove the password from the .key file and uploaded it again.

It works and e-mail is flowing but we are getting a chain error now on the TLS test site.

 Certificate 1 of 1 in chain: Cert VALIDATION ERROR(S): unable to get local issuer certificate; unable to verify the first certificate
        So email is encrypted but the recipient domain is not verified

We did upload the intermediate certificate but the root CA cert was already there.

Since mail is flowing (mostly) again I will leave the troubleshooting of this error for another day.

I know it's not a fix, but with XG you can revert back, to the old firmware, easily, just to get things moving :-)

I hope you do not have the Sophos C0nnect issues though in 17.5 MR-4-0 ;)

But …  Haven't Sophos' support been more curious than that ?

Paul Jr

Hello Paul,

The behavior was changed since 17.5 from 17.1 and we plan to get the issue sorted out soon. In the meantime, you would need to manually add the intermediate certificate chain.

REF:42752

I think it will win 17.5.6 which currently does not have a release date.

Ian

This virtual appliance is dedicated to protecting a mail server so I don't use Sophos Connect on this particular box. It was upgraded all the way to SF 17.5 MR4-1 (17.5.4.429) so I guess I'm at the bleading edge now :)