Gateways, TLS certificate DN and TLS certificate issuer CA

Question

We have a client that is going to be sending his emails via TLS encryption and he is asking some information from us. He sent us a form to fill in and I have 3 fields to complete and I have no idea what they mean.

I need this information:

• Gateways
• TLS certificate DN
• TLS certificate issuer CA

We work on Google Apps for Business and we use Postini for encrypting our emails (a client in the past asked for it).

I talked to the reseller who sold us and configured our emails through Postini but he is an idiot, so that is why I´m asking here if anyone knows where to get this information from

Answer 1

First the terms:

• TLS certificate would be your digital certificate that validates your server.

• DN is simply your domain name, such as webapps.stackexchange.com.

• Certificate issuer CA is the certifying authority, such as VeriSign.

Now as far as giving this out, I am unable to figure out why anyone would need any of this. They would only need to know the address that your TLS mail server is located at. The sender would never send this information at all, but rather establishes a connection to the server stating that they want to continue using TLS. The connection process (in tech speak the handshake) in general goes this way:

1. Client (the person/server sending you the email) and server (your email server) make contact and agree on an encryption algorithm to continue under.
2. The client and server then use public/private keys to exchange certification and validate each other. The specifics of this step vary depending on the methods agreed to in the first step.
3. A new secret key is created between the two that is used for the now validated session and will normally be destroyed once the communication is completed.

In my own opinion if your "client" is asking for these details in this way I would be extremely cautious about what their goals are and/or that they are actually sure of what they are doing. One other reason they may be asking you for this information is that they are mistakenly trying to setup outgoing TLS encryption from their end and are misunderstanding that those details would actually be their own personal/bought and paid for certificate details.