Re: per domain TLS

2010-09-02 Thread Vernon A. Fort
On Tue, 2010-08-24 at 11:43 -0500, Vernon A. Fort wrote: On Tue, 2010-08-24 at 10:29 -0500, Noel Jones wrote: On 8/24/2010 10:24 AM, Vernon A. Fort wrote: We have a few companies that we need have ALL email traffic encrypted. We can no longer 'blindly trust' the end user to not include

Re: per domain TLS

2010-09-02 Thread Victor Duchovni
On Thu, Sep 02, 2010 at 12:41:47PM -0500, Vernon A. Fort wrote: Concerning outbound email to a specific domain that I need encrypted, I use smtp_tls_policy_maps. I would like some level of verification that the remote server IS the server I think it is. I see the smtp_tls_security_level as

Re: per domain TLS

2010-09-02 Thread Vernon A. Fort
On Thu, 2010-09-02 at 13:47 -0400, Victor Duchovni wrote: On Thu, Sep 02, 2010 at 12:41:47PM -0500, Vernon A. Fort wrote: Concerning outbound email to a specific domain that I need encrypted, I use smtp_tls_policy_maps. I would like some level of verification that the remote server IS

Re: per domain TLS

2010-09-02 Thread Victor Duchovni
On Thu, Sep 02, 2010 at 01:30:24PM -0500, Vernon A. Fort wrote: The choice between fingerprint and secure depends on whether the remote cert is self-signed and stable, or signed public CA and changes each time it expires. OK - so i get them to send me their cert file - then create a

Re: per domain TLS

2010-08-24 Thread Vernon A. Fort
On Tue, 2010-08-24 at 10:29 -0500, Noel Jones wrote: On 8/24/2010 10:24 AM, Vernon A. Fort wrote: We have a few companies that we need have ALL email traffic encrypted. We can no longer 'blindly trust' the end user to not include sensitive information in email. A VPN would be a easier