Mutual TLS (mTLS) provides a significant security enhancement for your email infrastructure. While standard TLS encrypts the connection and verifies the server's identity, mTLS adds a crucial second layer of security by requiring the client (the sending server) to present its own certificate, which is also verified.
Standard TLS: Your server (the bouncer) shows its ID to the connecting server to prove it's the real destination.
Mutual TLS (mTLS): The bouncer shows its ID, and then demands to see the guest's ID as well. Only if both parties are verified is the connection allowed.
Follow the steps below to configure mTLS for both receiving (inbound) and delivering (outbound) email on your Trellix appliance.
Step 1: Obtain and Upload Your mTLS Certificates
Before you can enable mTLS, you must have the correct certificates installed on the appliance. The Trellix appliance uses a single, dual-use certificate for both its server (inbound) and client (outbound) mTLS roles.
You will need:
A Certificate signed by your organization's Certificate Authority (CA).
The matching Private Key.
The public root/intermediate CA Certificate for your CA.
To obtain and install this certificate, follow these steps:
Log in to your Trellix appliance's admin interface.
Go to Settings > Certificates/Keys.
Find the MTA Certificate Configuration section and click the gear icon.
Select Create Certificate Signing Request (CSR).
Fill out the CSR form. Ensure the Common Name (CN) matches the fully qualified domain name (FQDN) of your appliance (e.g., mta.yourcompany.com).
Download the generated .csr (signing request) file.
Provide this CSR file to your internal IT security team or Certificate Authority to be signed. They will return a signed certificate file (e.g., .crt or .pem).
Return to the MTA Certificate Configuration section on the appliance and click the gear icon again.
Select Import Certificate.
Upload the signed certificate file you received from your CA, as well as the Root/Intermediate CA certificate (your CA's public certificate).
Once uploaded, make this new certificate Active for the MTA.
Step 2: Enforce Global TLS (Prerequisite)
mTLS cannot be enabled unless standard TLS is already required. You must set your global TLS policies for both receiving and delivering email to mandatory. Run the following commands from the appliance's CLI:
email-analysis tls receive mandatory: Sets global inbound (receive) TLS to mandatory.
email-analysis tls delivery mandatory: Sets global outbound (deliver) TLS to mandatory.
Step 3: Enforce Domain-Level TLS (Prerequisite)
In addition to the global settings, you must specify which partner domains you want to enforce mTLS with. You must set the TLS policy for these specific domains to mandatory or verify. Run the following command for each partner domain:
email-analysis domain <domain_name> tls-policy mandatory: Replace <domain_name> with your partner's domain.
Step 4: Enable the mTLS Feature
Once your certificates are active and your TLS prerequisites are set, you can enable the mTLS feature. This command instructs the appliance to request a client certificate during a TLS handshake and to send its own client certificate when a downstream MTA requests it. Run the following command from the appliance's CLI:
email-analysis mta options mtls-request-cert: To enable mTLS
[no] email-analysis mta options mtls-request-cert: To disable mTLS
Step 5: Verification
After completing the configuration, you should send test emails to and from your mTLS-configured partner. You can verify that mTLS is working by inspecting the mail logs:
For Inbound mTLS (Receiving an email): The mail log on your Trellix appliance will show a Trusted TLS connection established... message, indicating it successfully verified the sender's client certificate.
For Outbound mTLS (Sending an email): The mail log on your Trellix appliance will show a Verified TLS connection established... message, indicating it successfully verified the downstream server's certificate. The logs on the partner's (receiving) server will show a Trusted TLS connection message, confirming it received and verified your appliance's certificate.