Is there a way to test a SSL certificate for a SMTP server?

Question

A couple of months ago, my company bought a Rapid SSL Certificate which supports until 256-bits cryptography and which is used both for communication between our mobile apps and our server and to send emails by our SMTP server, which is also inside our Windows Server 2012 R2. I correctly managed to install it by IIS 6 in a custom SMTP server. Everything seems to work fine but only a company associated with ours told us that our SMTP server cannot connect to their incoming email server because

the certificate we use could not be "compatible" with new SHA256 cryptography standards.

I don't know exactly what this means but I called our certificate provider and they assured us the certificate we bought is correct. Moreover, I am quite sure that company is wrong because our SMTP certificate is able to connect not only to Gmail accounts but also to many other incoming email servers using that certificate. And messages have always been correctly delivered. So, I don't know where and how to investigate for the problem.

Generally, our SMTP server is evoked by .NET web applications deployed on our server Windows 2012 R2 like the following:

IDMailer M = null;
M = (IDMailer)new IDMailer();
M.FromAddress = new IDVariant(v_VEMAILRESIDE).stringValue();
M.Subject = IDL.FormatMessage((new IDVariant("|1: manutenzione ODL |2")), v_VNOMERESIDEN, v_ODL).stringValue();
M.SetRelayServer((new IDVariant("www.ourserver.it")).stringValue(), (new IDVariant(25)).intValue(), (new IDVariant("username")).stringValue(), (new IDVariant("password")).stringValue(),(new IDVariant(-1)).booleanValue()); 
M.HTMLBody = new IDVariant(v_HTML_MESSAGE).stringValue();

As you can see, the IDMailer (from framework System.Net.Mail) is set both to use our server as relay and to use cryptography to connect to relay (last parameter). Thus, I don't really know where to investigate for the problem or even whether the problem exists and is ours.

UPDATE

As suggested, I try to analyze the mail servers with this site using one of our customers email in order to test the secure connection to their incoming mail server.

This is a first summary report:

from which I got confirmation that their authoritative incoming mail server are the first two. Then, this is the log of the first server (the one the second is identical)

from which I understood the problem might be theirs, as

TLS in not an option on this server

I mean that it might be their server which do not support TLS. Thus, as our SMTP server exclusively works with a SSL certificate, then it cannot connect to their incoming mail server. Am I right or am I missing anything else?

Solution 1

have you tried a site like http://checktls.com? I used it when we had a company report that they were receiving random cert errors when connecting to our mail servers. Was able to determine that one box had the incorrect cert applied.

Solution 2

That error message looks more like they have a problem with the signature on your Windows server. That is separate from the SSL certificate which applies to the connection but not the identity of your server. Windows likes to sign things with a MD5 security wrapper unless you specifically say otherwise. MD5 was broken so certs wrapped using MD5 are no longer a valid check of identification. You'll need to check and reissue the cert which identifies your mail server to one wrapped with SHA256.

Comments

[Lory Lory]

Thank you mate, very kind of yours. I have to study how that site works But it looks interesting so I will have a test with that site next monday as soon as I'm at the office. I'll let you know here because I'm sure I will make a mess. Thank you :)

[Lory Lory]

forgive me for the late. I tried to test things with the site you suggested to me and I've juts updated my answer if you want to have a look...

[Lory Lory]

Thank you very much mate, not it sounds a little clearer. But, how have you understood there's a problem with our Windows Server? Because I did not give checktls.com any parameter to use our SMTP server...just a destination email of our customers. Moreover, how can I "check and reissue" our certificate with SHA256? Shall I call our certificate provider or shall I execute anything on Wndows Server? Forgive me for all these questions because I am a bad System Engineer

[Rowan Hawkins]

So the website that the other answer sent you two it's for checking the destinations TLS compatibility. It looks like the error message you received was from when you were trying to connect from your domain. The information from checktls website isn't throwing the sha256 error message because their server cert is wrapped with sha256 already.

[Lory Lory]

I've just tried to exec the test from the site through Google Chrome but this it I run it in my Windows Server 2012. I get the same result. So now, what exactly should I do? Shall I wrap my certificate with SHA256? if yes, how?

[Rowan Hawkins]

Our domain isn't running 2012 and also we have hosted exchange so I cant look at an instance to say for sure. What I mentioned was because one of our clients created a cert from a CRL, on a MS server and had that exact error when we installed their provided cert on our system. They later provided a cert wrapped in sha256 and that worked fine.