Configuring profiles : Configuring security profiles : Configuring TLS security profiles
Configuring TLS security profiles
The TLS tab lets you create TLS profiles, which contain settings for TLS-secured connections.
TLS profiles, unlike other types of profiles, are applied through access control rules and message delivery rules, not policies. For more information, see “Controlling SMTP access and delivery”.
To access this part of the web UI, your administrator account’s access profile must have Read or Read-Write permission to the Policy category. For details, see “About administrator account permissions and domains”.
To view the list of TLS profiles, go to Profile > Security > TLS.
 
GUI item
Description
Clone
(button)
Click the row corresponding to the profile whose settings you want to duplicate when creating the new profile, then click Clone. A single-field dialog appears. Enter a name for the new profile. Click OK.
Profile Name
Displays the name of the profile.
TLS Level
Displays the security level of the TLS connection.
• None: Disables TLS. Requests for a TLS connection will be ignored.
• Preferred: Allow a simple TLS connection, but do not require it. Data is not encrypted, nor is the identity of the server validated with a certificate.
• Encrypt: Requires a basic TLS connection. Failure to negotiate a TLS connection results in the connection being rejected according to the Action on failure setting.
• Secure: Requires a certificate-authenticated TLS connection. CA certificates must be installed on the FortiMail unit before they can be used for secure TLS connections. For information on installing CA certificates, see “Managing certificate authority certificates”.
Action On Failure
Indicates the action the FortiMail unit takes when a TLS connection cannot be established, either:
• Temporarily Fail: Reply to the SMTP client with a code indicating temporary failure.
• Fail: Reject the email and reply to the SMTP client with SMTP reply code 550.
This option does not apply and will be empty for profiles whose TLS Level is Preferred.
(Green dot in column heading)
Indicates whether or not the entry is currently referred to by another item in the configuration. If another item is using this entry, a red dot appears in this column, and the entry cannot be deleted.
To configure a TLS profile
1. Go to Profile > Security > TLS.
A dialog appears.
2. Either click New to add a profile or double-click a profile to modify it.
3. For a new profile, enter the name of the profile in Profile name.
4. From TLS level, select the security level of the TLS profile:
• None: Disables TLS. Requests for a TLS connection will be ignored.
• Preferred: Allows a simple TLS connection, but does not require it. Data is not encrypted, nor is the identity of the server validated with a certificate.
• Encrypt: Requires a basic TLS connection. Failure to negotiate a TLS connection results in the connection being rejected according to the Action on failure setting.
• Secure: Requires a certificate-authenticated TLS connection. CA certificates must be installed on the FortiMail unit before they can be used for secure TLS connections.
The availability of the following options varies by your selection in TLS level.
5. Configure the following, as applicable:
 
GUI item
 
Description
Action on failure
Select whether to fail or temporarily fail if a TLS connection with the parameters described in the TLS profile cannot be established.
This option does not appear if TLS level is Preferred.
Check CA issuer
Enable and enter a string on the CA issuer field. The FortiMail unit will compare the string in the CA issuer field with the field with that same name in the installed CA certificates.
This option appears only if TLS level is Secure.
 
CA issuer
Select the type of match required when the FortiMail unit compares the string in the CA Issuer field and the same field in the installed CA certificates. For more information on CA certificates, see “Managing certificate authority certificates”.
Check CA issuer must be enabled for CA issuer to have any effect.
This option appears only if TLS level is Secure.
 
Lookup CA
To populate the CA issuer field with text from a CA certificate’s CA Issuer, select the name of a CA certificate that you have uploaded to the FortiMail unit.
Check certificate subject
Enable and enter a string in the Certificate subject field. The FortiMail unit will compare the string in the Certificate subject field with the field with that same name in the installed CA certificates.
This option appears only if TLS level is Secure.
 
Certificate subject
Select the type of match required when the FortiMail unit compares the string in the Certificate subject and the same field in the installed CA certificates.
Check certificate subject must be enabled for Certificate subject to have any effect.
This option appears only if TLS level is Secure.
Check encryption strength
Enable to require a minimum level of encryption strength. Also configure Minimum encryption strength.
This option appears only if TLS level is Encrypt or Secure.
 
Minimum encryption strength
Enter the bit size of the encryption key. Greater key size results in stronger encryption, but requires more processing resources.