Implement SMTP server checks using STARTTLS
8 posts
Good idea, and it's now done. A newer build with it is in snapshots.
Just add the server with port 25 or 587, both of which are now in the port list of the host dialog as SMTP STARTTLS. Certificate Monitor connects, issues STARTTLS and checks the certificate the server presents, with the same expiry, chain, hostname and grade checks as any other host. In the details panel the TLS version is shown with (STARTTLS) next to it.
If a server doesn't offer STARTTLS, or refuses it, the host is shown as a TLS error, since such a server only accepts mail unencrypted. Port 465 (SMTPS) is checked with direct TLS, as before.
It would also be great to have a checkbox for each job that allows to disable the certchain-check. Some applications do not provide a chain, but only the certificate itself.
Who issued the certificate on those servers: a public CA such as Let's Encrypt or DigiCert, or your own internal CA?
A plain checkbox may not be a good idea, because the same check also catches an untrusted issuer or an invalid signature, and switching it off would hide those too.
If it's a public CA, Certificate Monitor could fetch the missing intermediate itself, as browsers do. If it's your own CA, importing its certificate into Trusted Root Certification Authorities in Windows fixes it as is.
It's Let's Encrypt. I have an application that provides only the certificate, without the chain (even though 'fullchain.pem' is being used). Chrome, Edge, and Firefox do not report any certificate errors, but the certificate monitor indicates a chain error.
Thanks, that settled it. Certificate Monitor now downloads a missing intermediate certificate the way browsers do, so your server should now show as OK. The fix is in snapshots - please download it again.
Such a server is still graded B at most, because many non-browser clients can't complete the chain, so it's worth getting the application to send the intermediate too.