We are looking at implementing TLS on our C360 Email Appliances. I have looked into generating a CSR and am fine except for the hostname to use in the common name field.
I know that with secure websites it is the name of the website followed by the domain e.g. www.externaldomain.com, portal.externaldomain.com.
What hostname do you use with TLS with the Ironport email appliance?
I think that it is the external MX record name (mail.externaldomain.com) as this is what other email systems would be connecting to, but there is also the FQDN of the Ironport appliance and the hostname of the IP Interface for outgoing email (as this appears in the 'Received from' field when sending external emails).
I ended up specifying both names, and using a Verisign purchased certificate and specified Subject Alternative Naming (SAN), which allows you to specify two or more commonnames for the certificate. In my case, I have an internal listener, with an internal hostname, and an external listener, with an external hostname. I was able to use a single certificate to satisfy both interfaces, of course, Verisign charges your for 2 certificates, if you specify a common name and a SAN.
I'm guessing other vendors offer something similar to Verisign's SAN.
It's worth noting that you could use separate certificates for receiving and sending e-mails as well as for HTTPS management and LDAPS. So in your case you might have used a separate no-cost self-signed certificate for the internal listener assuming that your security policy allows using self-signed certs and that would not pose additional security risks for your environment.
I decided to go ahead with a free trial SSL certificate using the external MX record name as the hostname as this seemed to be the logical solution and it is working like a charm. Just need to buy the real thing in 90 days time.
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...