Mimecast not supporting ISRG Root certicifcates?

Help
1

Hello.

I have a client unable to receive email from Mimecast users. They are using a Let's Encrypt certificate for TLS. Generally, this works ok.

However Mimecast does not list ISRG root certificates as being supported. The end result appears as bounced mail back to the sender using Mimecast stating that the mail delivery cannot be encrypted. Recommended Mimecast settings are that mail delivery must be encrypted, but if the root certificates are not, then then this will fail.

Mimecast does list a large number of Trusted Roots - is there any reason that ISRG ones are not on there? It seems a hole in at least Mimecast's system, but I wonder what ISRG does to establish its Root certificates are trusted in the world - I assumed they just work, but it looks like not.

I will be taking this up with Mimecast also where I can.

Thanks

Ken.

2

Mimecast supports both 1024-bit and 2048-bit certificates. The list below covers all the SSL certificates that Mimecast supports:

looks like that doesn't support any ecc or RSA bigger than 2048bits (from the list they don't have any ecc or 4096 bit rsa roots): as ISRG X1 root is 4096bits I'd not surprised if they don't support that cipher

2 Likes
3

Given on that list there are still widely distrusted CAs, Symantec and StartSSL, it indicates the list to be poorly maintained.

1 Like