PMDF System Manager's Guide

The maytls , maytlsclient , maytlsserver , musttls , musttlsclient , musttlsserver , notls , notlsclient , notlsserver , and tlsswitchchannel channel keywords are used to configure TLS use during the SMTP protocol by SMTP based channels such as TCP/IP channels. notls is the default, and means that TLS will not be permitted or attempted. It subsumes the notlsclient keyword, which means that TLS use will not be attempted by the PMDF SMTP client on outgoing connections (the STARTTLS command will not be issued during outgoing connections) and the notlsserver keyword, which means that TLS use will not be permitted by the PMDF SMTP server on incoming connections (the STARTTLS extension will not be advertised by the SMTP server nor the command itself accepted). Specifying maytls causes PMDF to offer TLS to incoming connections and to attempt TLS upon outgoing connections. It subsumes maytlsclient , which means that the PMDF SMTP client will attempt TLS use when sending outgoing messages, if sending to an SMTP server that supports TLS, and maytlsserver , which means that the PMDF SMTP server will advertise support for the STARTTLS extension and will allow TLS use when receiving messages. Specifying musttls will cause PMDF to insist upon TLS in both outgoing and incoming connections; e-mail will not be exchanged with remote systems that fail to successfully negotiate TLS use. It subsumes musttlsclient , which means that the PMDF SMTP client will insist on TLS use when sending outgoing messages and will not send to SMTP servers that do not successfully negotiate TLS use (PMDF will issue the STARTTLS command and that command must succeed), and musttlsserver , which means that the PMDF SMTP server will advertise support for the STARTTLS extension and will insist upon TLS use when receiving incoming messages and will not accept messages from clients that do not successfully negotiate TLS use. The tlsswitchchannel keyword is used to cause incoming connections to be switched to a specified channel upon a client's successful TLS negotiation. It takes a required value, specifying the channel to which to switch.

See Chapter 15 for additional discussion of TLS.