GTI IP reputation requests fail on Security for Microsoft Exchange Servers

Technical Articles ID: KB92614
Last Modified: 2023-06-26 09:10:16 Etc/GMT

Environment

Security for Microsoft Exchange (SME) 8.x

Problem

SME fails to communicate with the trustedsource.org server for GTI IP Reputation requests. This issue occurs when the Microsoft Exchange Server is configured to use only TLS1.2.

System Change

The TLS cipher suite isn't present or is disabled on the Microsoft Exchange Server.

Possible causes:

An Exchange Server update.
An administrator disabled one or more of the needed cipher suites.

Cause

Missing or disabled ciphers are needed on the Microsoft Exchange Server to communicate with the trusted source server using TLS 1.2.

Solution 1

Install one of the following supported ciphers, listed in order of preference:

AES256-GCM-SHA384
AES256-SHA256
AES256-SHA
CAMELLIA256-SHA
AES128-GCM-SHA256
AES128-SHA256
AES128-SHA
SEED-SHA
CAMELLIA128-SHA
IDEA-CBC-SHA
RC4-SHA
RC4-MD5
DES-CBC3-SHA
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384

Solution 2

Add non-default ciphers to Windows 2019:

Press Windows+R, type gpedit.msc in the field, and then press Enter.
Go to Computer Configuration, Administrative Templates, Network, SSL Configuration Settings.
Enable Cipher suite order.
In the list of SSL Cipher Suites (blue box), add GTI supported suites separated by a comma. For example, TLS_RSA_WITH_AES_128_CBC_SHA256.

Example of the content of SSL Cipher suites:

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256,
TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256
Click Apply.
Restart the server.
Verify the newly added ciphers with a cypher check tool, such as IISCrypto.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

GTI IP reputation requests fail on Security for Microsoft Exchange Servers

Environment

Problem

System Change

Cause

Solution 1

Solution 2

Affected Products

Languages:

Title

Title

Knowledge Center

GTI IP reputation requests fail on Security for Microsoft Exchange Servers

Environment

Problem

System Change

Cause

Solution 1

Solution 2

Affected Products

Languages:

Choose your region

Title

Title