How can I select a specific certificate to scan inbound E-mail trafic (SMTP) ?

Hi Slawski,

Can you please confirm me if the Business Rule configured for Mail Server has Reflexive Rule enable ?

Reflexive rule has the same policies as those configured for the hosted server but instead of source zone to destination zone, this rule is applicable on traffic from destination zone to source zone. By default, the reflexive rule is not created.

If you have already seleted SMTP / SMTPS Scan option in your Business Rule with Reflexive Rule enable, this will scan all the Inbound E-mail traffic as per the requirement.

You have reported the same query in your last post to forum, you can also follow up on that,  find the link to the same.

https://community.sophos.com/products/xg-firewall/f/130/p/75121/289809#289809

Thanks

Sachin Gurung

Does this problem have a solution yet? With this unaddressed clients connecting to your SMTPS services will not be given a trusted certificate because is always signed by the CA on the firewall (which will not be trusted on all clients).

I assert that the practice of using the CA cert for scanning TLS SMTP and HTTP is broken because the common case is that for _hosted_ services the certificate is also used to verify identity through a valid chain of trust. There *should* be an option to upload trusted signed certificates for hosted services just as it is normal to do so in a reverse proxy, which is essentially what is happening when hosted SMTPS and HTTPS is scanned using this software.

**Edit: HTTPS business rule works fine for this case** 

Hi Matthew,

Did you look into the options;

• Protection
• Email Protection
• Configuration

SMTP / POP and IMAP TLS Configuration.

Hope that helps.

This picture illustrates the problem:

 The same applies to SMTPS. It is normal for a reverse proxy to be able to use the trusted client certificate so that the internet user has a valid chain of trust.

'SMTP / POP and IMAP TLS Configuration' does not appear to address the problem.

I can see that someone understood what I have complained about. Yes the picture is exactly showing the case.

If you have an internal server protected by public certificate, there is no way to protect it with Business rule, because there is no way to select that certificate in the Business Rule.

The main failure here as I see it is that Sophos engineers expect the functional requirements of a reverse proxy to be identical to a normal web proxy. This leaves the SMTPS scanning feature only partially implemented.

But HTTPS Business rule is implemented correctly... SMTP - not.

Ah so it is! It looks like they just missed it for SMTPS. Hopefully a simple fix then.

Ah so it is! It looks like they just missed it for SMTPS. Hopefully a simple fix then.