Press CTRL+K to open search

email ssl

  • Published on Aug 4, 2026
  • 1 minute(s) read
Prev Next

To configure security for the server used to send system email notifications, use the email ssl command in configuration mode.

Syntax

[no] email ssl ca-list {none, default-ca-list}

[no] email ssl cert-verify

[no] email ssl cipher-list {original| fips| cc-ndcpp| fips-and-cc-ndcpp | fips-high-security | cc-ndcpp-high-security | fips-and-cc-ndcpp high-security | compatible}

[no] email ssl min-version {ssl3 | tls1 | tls1.1 | tls1.2}

[no] email ssl mode {none | tls | tls-none}

Parameters

no

Clears the email configuration.

ca-list {none, default_ca_list}

Configures the supplemental CA certificates that are used to verify the server certificates.

  • none—No supplemental list; use the built-in supplemental CA certificate list only.

  • default-ca-list—Default supplemental CA certificate list.

cert-verify

Verifies the server certificates. If the server certificates cannot be verified, TLS will fail.

cipher-list {original| fips| cc-ndcpp| fips-and-cc-ndcpp | high-security | compatible}

Configures the cipher list for SSL/TLS:

  • original—Original FireEye cipher list (maximum compatibility)

  • fips—Compliant with FIPS

  • cc-ndcpp—Compliant with CC-NDPP

  • fips-and-cc-ndcpp—Compliant with both FIPS and CC-NDPP

  • fips-high-security—A set of ciphers required by FIPS certification that excludes low-security ciphers

  • cc-ndcpp-high-security—A set of ciphers required by CC-NDPP certification that excludes low-security ciphers

  • fips-and-cc-ndcpp-high-security—A set of ciphers required by both FIPS CC-NDPP certification that excludes low-security ciphers

  • compatible—Improved security while maintaining backward compatibility

min-version {ssl3 | tls1 | tls1.1 | tls1.2}

Selects the version of TLSv1 to use for secure email. The default version is tls1.2.

mode {none | tls | tls-none}

Configures the following security types to use for email:

  • none—TLS is not used to secure email.

  • TLS—Configures TLS over the default server port to secure email. If TLS fails, email cannot be sent.

  • tls-none—Sets TLS Preferred to attempt TLS over the default server port to secure email. If TLS Preferred fails, plain text must be used.

autosupport ssl ca-list {none, default-ca-list}

Configures the supplemental Certificate Authority (CA) certificates that are used to verify the server certificates.

  • none—No supplemental list; use built-in one only.

  • default-ca-list—Default supplemental CA certificate list.

autosupport ssl cert-verify

Verifies the server certificates.

autosupport ssl mode {none | tls | tls-none}

Configures the following security types to use for autosupport email:

  • none—Transport Layer Security (TLS) is not used to secure autosupport email.

  • TLS—Configures TLS over the default server port to secure autosupport email. Email cannot be sent if TLS fails.

  • tls-none—Sets TLS Preferred to attempt TLS over the default server port to secure autosupport email. Plain text must be used if TLS Preferred fails.

Example

This example specifies that TLS must be used to secure mail.

hostname (config) # email ssl mode tls

User role

Admin, Operator, or Analyst

Supported appliances

This command is supported on the following appliances running the specified releases or later:

  • Email Security — Server: Release 7.6.0

Related articles