<profile_name>

Enter the name of the profile.

level {none | preferred | secure}

Select whether SSL/TLS is supported or required:

• none: Disables SSL/TLS. Requests for secure connections will be ignored.

• preferred: If the other device in the SMTP session supports STARTTLS, then FortiMail tries to use it.

• secure: Require a certificate-authenticated SSL/TLS connection. See information on installing a CA certificate on FortiMail.

Effects vary by directionality and global settings. For details, see FortiMail TLS behavior in both directions of mail flow.

action {fail | tempfail}

Select the action FortiMail performs when an SSL/TLS connection cannot be established, either:

• fail: Reject the email and reply to the SMTP client with SMTP reply code 550.

• tempfail: Reply to the SMTP client with a code indicating temporary failure.

This option does not apply if level {none | preferred | secure} is preferred.

Tip: Optionally, you can configure protocol {ibe | ibe-on-tls-failure | smime} to try IBE if TLS fails. IBE also ensures that the email message is encrypted in transit.

ca-name "<ca-dn_str>"

Enter a string that matches only trusted CAs.

Use forward slashes to separate each part of the Distinguished Name (DN). For example:

/CN=ca.example.com/O=Example Inc.

This option is only available when level {none | preferred | secure} is secure, and only takes effect if check-ca-name {enable | disable} is enable.

cert-subject "<subject-dn_str>"

Enter a string that matches only accepted certificate subjects.

Use forward slashes to separate each part of the Distinguished Name (DN). For example:

/CN=mail.example.com/O=Example Inc.

This option is only available when level {none | preferred | secure} is secure, and only takes effect if check-cert-subject {enable | disable} is enable.

check-ca-name {enable | disable}

Enable to perform the action in action {fail | tempfail} if connection peer's certificate's CA Issuer field (its signing CA) does not match ca-name "<ca-dn_str>".

Each certificate's signature is validated with the list of trusted CA certificates (for information on installing CA certificates, see the FortiMail Administration Guide.), so this additional CA setting effectively filters which trusted CAs can be used by specific sessions.

This option is only available when level {none | preferred | secure} is set to secure.

check-ca-type {match | substring | wildcard}

Select how to compare this setting with the peer certificate's CA Issuer field:

• match (equal)

• substring (contain)

• wildcard (some characters may vary, which are indicated by a question mark ( ? ) or asterisk ( * ) )

This option is only available when level {none | preferred | secure} is secure, and only takes effect if check-ca-name {enable | disable} is enable.

check-cert-subject {enable | disable}

Enable to perform the action in action {fail | tempfail} if connection peer's certificate's Subject field does not match cert-subject "<subject-dn_str>".

This option is only available when level {none | preferred | secure} is secure.

check-cert-type {match | substring | wildcard}

Select how to compare this setting with the peer certificate's Subject field:

• match (equal)

• substring (contain)

• wildcard (some characters may vary, which are indicated by a question mark ( ? ) or asterisk ( * ) )

This option is only available when level {none | preferred | secure} is secure, and only takes effect if check-cert-subject {enable | disable} is enable.

check-encryption-strength {enable | disable}

Enable to perform the action in action {fail | tempfail} if the connection does not meet encryption-strength <bits_int>.

This option is only available when level {none | preferred | secure} is secure.

check-ssl-version {enable | disable}

Enable to perform the action in action {fail | tempfail} if the connection does not meet min-ssl-version {ssl3 | tls1_0 | tls1_1 | tls1_2 | tls1_3}.

This option is only available when level {none | preferred | secure} is secure.

dane-support {mandatory | none | opportunistic}

Select the DNS-based Authentication of Named Entities (DANE) support level:

• None
• Opportunistic
• Mandatory (only available if level {none | preferred | secure} is secure)

See also RFC 7929.

encryption-strength <bits_int>

Enter the bit size of the encryption key. Greater key size results in stronger encryption, but requires more processing resources.

This setting takes effect only if check-encryption-strength {enable | disable} is enabled. Effects also can be overridden by encryption strength settings such as strong-crypto {enable | disable}.

min-ssl-version {ssl3 | tls1_0 | tls1_1 | tls1_2 | tls1_3}

Select the required minimum secure connection protocol and version, either:

• TLS 1.3

• TLS 1.2

• TLS 1.1

• TLS 1.0

• SSL 3.0

This option is only available when check-ssl-version {enable | disable} is enable. Effects also can be overridden by encryption strength settings such as strong-crypto {enable | disable}.