Mail server TLS certificate

After negotiating STARTTLS, the probe reads the certificate the mail server presents and checks two things: whether it covers the MX hostname that was connected to, and how long it has left before expiry.

A name mismatch is graded as a warning, and the reason is uncomfortable: today it mostly does not matter. Opportunistic TLS senders generally do not verify the name, so a certificate issued for the hosting provider's own hostname encrypts the session exactly as well as a correct one would. What it does not do is authenticate it — an attacker on the path presenting any certificate at all gets the same acceptance.

It stops being harmless the moment anybody hardens anything. A sender honouring an MTA-STS policy in enforce mode requires the certificate to be valid for the MX hostname, and DANE requires it to match the TLSA record. So a mismatch is a landmine: the domain works, publishes a policy, and begins bouncing mail from precisely the senders that took security seriously.

An expired certificate is graded as a failure. Opportunistic senders vary in what they do with one — some proceed, some downgrade to plaintext, some defer — and none of that is behaviour you want your inbound mail deciding for itself.

Issue the certificate for the MX hostname, not for the mail domain. mail.example.com is the name senders connect to and the name they check; example.com in the subject alternative names is not what is being validated here.

Automate renewal and the reload together. An MTA holds its certificate in memory, so a renewed file that nothing told the daemon to re-read expires on schedule as if nobody had renewed it — and mail servers are restarted far less often than web servers, which is why this bites harder here.

Serve the full chain. The missing-intermediate problem that hides in browsers applies here with less forgiveness, because an MTA validating a chain has no cache of intermediates picked up from ordinary browsing.

If the MX belongs to a mail provider, the certificate is theirs and so is this finding. Worth knowing before you publish an MTA-STS policy in enforce mode, because their hostnames are what that policy has to name.