Data Loss Prevention

Back to discussions
Expand all | Collapse all

Network Prevent for Email TLS encryption

  • 1.  Network Prevent for Email TLS encryption

    Posted 3 days ago
    Hello,

    We use tls for our email communication. We have enabled tls on Symantec NP for Email servers. We have configured NP for Email for forwarding mode.
    I know that we have to generate self-signed certificates using keytool on Symantec, Export it and import that certificate on downstream MTA. And import the upstream MTAs certificate to NP for Email Servers.
    What if we do not want to use a self-signed certificate and want to use a CA.
    What is the procedure then?


  • 2.  RE: Network Prevent for Email TLS encryption

    Posted 2 days ago
    CA certificates cannot be used for Symantec DLP servers communication, as it doesn't have a full Certificate management system (cannot manage expired certs, etc.). However, from DLP servers to outside servers communications (LDAP, SMTP, AD, etc.), it should be fine to use any other certificates; make sure you understand what is a Truststore and a keystore, that you have to replace certificates when they expire, etc. All servers, MTAs and NP for mail should have everybody's certificates in order to pass/transfer emails through them.

    Good luck, and for questions related to certificates (create, import, export, etc.), your CA certificate team should know better how to handle them.
    A.C.
    Original Message


  • 3.  RE: Network Prevent for Email TLS encryption

    Posted yesterday
    Hello Zain,

    for outbound emails, you need to import the certificate in the certificate store of the NP-for-Email Server to communicate with the outsite world.
    There might be already public certs in the keystore which can be used to communicate with the outside would but some companies accept only their own one.
    For example:     inside company (  Symantec DLP NPForEmail server ---> ..  maybe Exchange ..  ) -----------outbound email ----------> (MIMECAST or other Email provider.... proofpoint is quite good in email and dlp ) .....  now the company ( lets say mimcast ) provides you with a cert and you just import this into your NPForEmail keystore

    That being said.. one problem: .. some companies are using intermediate cert as well, then you have to import both the rootCA and the intermediate one.
    I have seen problems caused by mimecast where the cert requirement were changed and then the outbound email flow was stopped, then you have to be quick to impor the new mimecast ( or other vendor) cert .

    to make it short: No you do NOT need necessary a selfsigned cert for outbound email communication. If a Vendor has its own one, then you have to ask them to provide it to you and you import it in DLP. We made this several times and it always has worked.

    Best Regards and good luck with the implementation
    Thomas Eisbein
    Original Message