The message looks like their mail servers are unable to recognise your certs as valid. I'm assuming they are connecting to the Ironport? Again I'm assuming these were the certificates you updated recently? Did you just regenerate the certificate request from the old one or create a new one and are you using the same certificate authority as previously? I'd suspect that you are either missing the intermediate certificates, or you are using the Ironport self signed, but either way it does point to then not recognising your certs as valid. It could also be that if you have some kind of mutual auth set up you aren't trusting them, but it's more likely your certs unless they happen to have made a change too. Difficult to tell without seeing the certificate config on the Ironport.
If I were you I'd do a quick check in the message tracking to see if you can see any connection made on the Ironport and hopefully this will give you more information. There are a couple of good guides for the TLS setup of Ironport on the web. Nick -----Original Message----- From: Pfefferkorn, Pete (pfeffepe) [mailto:pfeff...@ucmail.uc.edu] Sent: 05 March 2012 13:24 To: MS-Exchange Admin Issues Subject: Off topic, TLS connections new certificates. Kind of off topic and bear with me I'm not real familiar with certs. Exchange 2007 sp2/Ironport perimeter. We recently added new certificates to our systems. Some of our affiliates have established TLS connectors to our site for mandatory encryption between our sites. The remote site in question is running Exchange 2010 but when they try and send mail to our uc.edu domain name, all the messages get spooled. If they send to ucmail.uc.edu the mail goes through fine. The error they getting for the uc.edu domain is a 451 4.4.0 Primary target IP address responded with "44.4.7.5 Certificate validation failure". Uc.edu is our university wide domain name so I'm a little confused on how that comes into play with the TLS connectivity and mx/a records. Here is another error reported. A secure connection to domain-secured domain 'uc.edu' on connector 'UC TLS Connector' could not be established because the validation of the Transport Layer Security (TLS) certificate for uc.edu failed with status 'UntrustedRoot. Contact the administrator of uc.edu to resolve the problem, or remove the domain from the domain-secured list. Pete Pfefferkorn University of Cincinnati Information Technology Services Systems Analyst/Messaging Administrator Phone: (513) 556-9076 Fax: (513) 556-2042 Email: pete.pfefferk...@uc.edu --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist This electronic message contains information from CACI International Inc or subsidiary companies, which may be confidential, proprietary, privileged or otherwise protected from disclosure. The information is intended to be used solely by the recipient(s) named above. If you are not an intended recipient, be aware that any review, disclosure, copying, distribution or use of this transmission or its contents is prohibited. If you have received this transmission in error, please notify us immediately at postmas...@caci.co.uk Viruses: Although we have taken steps to ensure that this e-mail and attachments are free from any virus, we advise that in keeping with good computing practice the recipient should ensure they are actually virus free. CACI Limited. Registered in England & Wales. Registration No. 1649776. CACI House, Avonmore Road, London, W14 8TS. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist