Which components are required when encrypting SMTP with TLS on Cisco ESA when the sender requires TLS verification?

Question

Options

• Aself-signed certificate in PKCS#7 format
• BX.509 certificate and matching private key from a CA
• Cself-signed certificate in PKCS#12 format
• DDER certificate and matching public key from a CA

• A
  3% (1)
• B
  86% (25)
• C
  3% (1)
• D
  7% (2)

Explanation

When TLS is required with certificate verification (as opposed to opportunistic TLS), the remote sending mail server must be able to validate the ESA's certificate against a trusted Certificate Authority (CA). This requires two components: an X.509 certificate issued and signed by a recognized CA (so the remote party can verify its authenticity), and the corresponding private key installed on the ESA (needed to complete the TLS handshake). A self-signed certificate would not be trusted by an external sender performing TLS verification. PKCS#7 and PKCS#12 are packaging/container formats, not certificate types for this use case. DER is an encoding format (not a certificate type), and a public key alone is insufficient - the private key is what the ESA uses during the TLS negotiation.

No community discussion yet for this question.