TLS Profile on FortiMail and expired certificates

[StefanN]

Hi,

We introduced mandatory TLS (Security -> TLS -> TLS-Profile -> TLS-option = secure) a few months ago, which unfortunately has the disadvantage that connections are not only rejected when TLS is not an option on our connection partner but also get rejected if a TLS certificate on the receiving server has expired. Although encryption is still possible with an expired certificate, we then reject the SMTP connection. As far as I could find out, there is no possibility to configure a gradation in FortiMail. For example, if the server does not offer TLS, then reject the connection. But if it does offer TLS and only the certificate has expired, then connect.
Does anyone have any ideas on how we could implement this? It's quite annoying to keep an exception list for all customers who don't pay attention to their certificates...

Thank you!

[Jean-Philippe_P]

Hello StefanN, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

[AEK]

Hi Stefan

Following some research I found that even on CLI this is not possible.

https://docs.fortinet.com/document/fortimail/7.6.4/cli-reference/938081/profile-tls

I think it means when you want to enforce certificate check then you have to assume that it is not acceptable to have an expired certificate.

I personally set "TLS option" to "Preferred" (default), and leave the authentication part to the DNS configuration (rDNS, SPF and DKIM checks). And always use a trusted DNS server to avoid spoofing.