Using certificates to send mail via SMTP server

netware5

posted Mar 13 '14 at 9:21 pm

David,

Thank you very much for releasing of new Pegasus mail 4.70. Did you managed to use a client certificates for SMTP communication?

David,Thank you very much for releasing of new Pegasus mail 4.70. Did you managed to use a client certificates for SMTP communication?&nbsp; &nbsp;

netware5

posted Aug 21 '13 at 6:18 pm

Hi guys! My organisation is using Pegasus Mail & Mercury as main internal mail transport for many, many years. Recently we made some changes to allow our users to access their mailboxes and send e-mails when they are out of office. The SMTP server which is visible from outside of our LAN is Postfix and is configured to allow to external clients to relay messages only if a client certificate is presented. We created and signed the relevant certificates and distributed them to the clients. Everything works fine if the client is Thunderbird, but does not work if the client is Pegasus Mail. It seems to be that Pegasus Mail fails to handle the client certificate during TLS negotiation.

Configuration info:

- the clients used are Pegasus Mail versions 4.61 - 4.63

- the client OS is Windows XP

- the client certificate is imported in the Windows "personal" certificate store

- the SMTP profile in Pegasus Mail is server port: 587, SSL/TLS: "via STARTTLS", SMTP Authentication: "Login to SMTP server using the following details (username and password)"

So the question is:

Does the Pegasus Mail support client certificates for SMTP authentication using STARTTLS negotiation?

Hi guys! My organisation is using Pegasus Mail &amp; Mercury as main internal mail transport for many, many years. Recently we made some changes to allow our users to access their mailboxes and send e-mails when they are out of office. The SMTP server which is visible from outside of our LAN is Postfix and is configured to allow to external clients to relay messages only if a client certificate is presented. We created and signed the relevant certificates and distributed them to the clients. Everything works fine if the client is Thunderbird, but does not work if the client is Pegasus Mail. It seems to be that Pegasus Mail fails to handle the client certificate during TLS negotiation.Configuration info:- the clients used are Pegasus Mail versions 4.61 - 4.63- the client OS is Windows XP- the client certificate is imported in the Windows "personal" certificate store- the SMTP profile in Pegasus Mail is server port: 587, SSL/TLS: "via STARTTLS", SMTP Authentication: "Login to SMTP server using the following details (username and password)"So the question is:Does the Pegasus Mail support client certificates for SMTP authentication using STARTTLS negotiation?

Michael

posted Aug 21 '13 at 8:03 pm

[quote user="netware5"]Does the Pegasus Mail support client certificates for SMTP authentication using STARTTLS negotiation?[/quote]

No, it doesn't.

[quote user="netware5"]Does the Pegasus Mail support client certificates for SMTP authentication using STARTTLS negotiation?[/quote]No, it doesn't.

			Michael
--
IERenderer's Homepage
PGP Key ID (RSA 2048): 0xC45D831B
S/MIME Fingerprint: 94C6B471 0C623088 A5B27701 742B8666 3B7E657C

netware5

posted Aug 21 '13 at 8:50 pm

[quote user="idw"]

[quote user="netware5"]Does the Pegasus Mail support client certificates for SMTP authentication using STARTTLS negotiation?[/quote]

No, it doesn't.

[/quote]

Thank you Michael! Do you know if the future Pegasus Mail v.5 will support this feature?

[quote user="idw"][quote user="netware5"]Does the Pegasus Mail support client certificates for SMTP authentication using STARTTLS negotiation?[/quote]No, it doesn't.[/quote]Thank you Michael! Do you know if the future Pegasus Mail v.5 will support this feature?&nbsp;

Michael

posted Aug 21 '13 at 9:31 pm

[quote user="netware5"]Thank you Michael! Do you know if the future Pegasus Mail v.5 will support this feature?[/quote]

Since only David Harris can answer this I've forwarded your request to him

[quote user="netware5"]Thank you Michael! Do you know if the future Pegasus Mail v.5 will support this feature?[/quote]Since only David Harris can answer this I've forwarded your request to him

			Michael
--
IERenderer's Homepage
PGP Key ID (RSA 2048): 0xC45D831B
S/MIME Fingerprint: 94C6B471 0C623088 A5B27701 742B8666 3B7E657C

David Harris

posted Aug 24 '13 at 5:47 am

[quote user="netware5"]So the question is:

Does the Pegasus Mail support client certificates for SMTP authentication using STARTTLS negotiation?

[/quote]

Not in the current code. Indeed, you're the first person I'm aware of ever asking for this ability (although I've wondered how long it would be before someone did so).

The good news is that there is no reason why this won't be possible in v5. One of the huge number of changes I have made for v5 is moving to OpenSSL for all SSL/TLS encrypted traffic, and in the process of reworking the code, I specifically made allowance for the possibility of using client-side certificates. Incidentally, Mercury now also uses the same OpenSSL-based code for secure connections, and can use external or officially-issued standard .PEM based certificates, so the whole process should be markedly easier. Now that I am aware that there is a specific demand for this type of capability, I'll add steps to my internal testing regime to make sure it works.

I believe I am still on target for getting at least a wide-consumption beta of v5 out the door before the end of the year, but it will be late in the year.

Cheers!

-- David --

[quote user="netware5"]So the question is:Does the Pegasus Mail support client certificates for SMTP authentication using STARTTLS negotiation? [/quote] Not in the current code. Indeed, you're the first person I'm aware of ever asking for this ability (although I've wondered how long it would be before someone did so). The good news is that there is no reason why this won't be possible in v5. One of the huge number of changes I have made for v5 is moving to OpenSSL for all SSL/TLS encrypted traffic, and in the process of reworking the code, I specifically made allowance for the possibility of using client-side certificates. Incidentally, Mercury now also uses the same OpenSSL-based code for secure connections, and can use external or officially-issued standard .PEM based certificates, so the whole process should be markedly easier. Now that I am aware that there is a specific demand for this type of capability, I'll add steps to my internal testing regime to make sure it works. I believe I am still on target for getting at least a wide-consumption beta of v5 out the door before the end of the year, but it will be late in the year. Cheers! -- David --

netware5

posted Aug 25 '13 at 4:07 pm

Thank you, David!

I am using Pegasus Mail since 1995 and I can not imagine to use any other e-mail client. I appreciate your efforts to maintain this excellent software for such a long time! I am ready to volunteer for testing the new beta when it become available.

Cheers!

Thank you, David!I am using Pegasus Mail&nbsp; since 1995 and I can not imagine to use any other e-mail client. I appreciate your efforts to maintain this excellent software for such a long time! I am ready to volunteer for testing the new beta when it become available.Cheers!

Related Topics

Pending draft

Confirm move posts

Insufficient permissions

Select a different topic

Edit history