Can I use TLS encryption with SMTP?

[bsommer]

Hello,
We currently use SMTP (TCPIP Services 5.6) to send mail, both with the $MAIL utility and TCPIP$SFF. Is it possible to use TLS encryption with AXP OpenVMS 8.3? If so, is there documentation anywhere?
Thanks

[Hoff]

You're potentially conflating your terminology here; please provide some added background on what you're looking to do with SSL/TLS security.

SPOP:

http://h71000.www7.hp.com/doc/83final/6526/6526pro_046.html

Or load a third-party stack.

Most folks that are interested in using SMTP for all but the most basic operations have migrated off TCP/IP Services some time ago, FWIW. Either to a third-party stack, or to a mail server on another platform.

OpenVMS itself does not offer a mail client that accesses a remote mail server for submissions, though at least one third-party vendor does offer such a transport image.

And AFAIK, OpenVMS provides no authenticated clients with the distro; you'll be using an add-on client or maybe a Mozilla package for that.

[bsommer]

We use OpenVMS to send SMTP mail to our Exchange server users for various notifications (jobs completed, business reports, etc). It also sends emails to customers (order confirmations, etc) We are exploring the possibility of having it automatically send sensitive information, such as financial reports, to vendors such as outside auditors. Obviously, we only want to do that if the data can be encrypted. TLS encryption allows Server-to-Server SMTP traffic to be encrypted. I am wondering if OpenVMS supports encrypting SMTP sessions using TLS.
Thanks,
Barry

[Hoff · Accepted solution]

In no particular order...

The OpenVMS TCP/IP Services SMTP support is comparatively feature-limited, and that's before getting to the ensuing discussions of security and encryption.

On the Internet, the SMTP (port 25) traffic is usually not encrypted, though some mail servers do offer the ability to create site-to-site TLS links. OpenVMS with TCP/IP Services is not among these servers.

Messages can also (obviously) be encrypted; you'll need to use a combination of MIME and an encryption tool; there are folks around that have been working with gpg toward this end, and there are other approaches.

I'd tend to avoid the HP GnuPG port if you do go this route, as Mr Schweda has a more stable port available.

http://antinode.info/dec/sw/gnupg.html

And look to link over to a more capable mail server, and trigger the send from that host. Or there's a remote-submission mechanism available from Process Software for their IP stacks, and the Process IP stacks tend to have more capabilities in this area.)

[Richard Whalen]

If you want to stay with TCP/IP Services, then consider using PMDF.

http://www.process.com/tcpip/pmdfds.pdf