microsoft / microsoft/CSS-Exchange
Detection for missing intermediate certificate for leaf cert used by Transport
@shasagar is already working on this.
Since Jan 22, 2025.
- Dominant language
- PowerShell
- Stars
- 1.3k
- Forks
- 395
- Avg merge
- 14h 7m
- Merged PRs (30d)
- 5
Description
Is your request related to a problem? Please describe.
UntrustedRoot is an error surfaced in Message Tracking Logs/Message Trace when the root certificate is not trusted or less commonly known a missing intermediate certificate during TLS negotiation.
Take the following scenario:
Exchange Online tenant is containing an outbound connector configured to enforce certificate validation. Mail is sent from Exchange Online to On-Premises. During TLS negotiation On-Premises only presents the leaf certificate and does not include any intermediate certs. This can be verified in a network packet capture.
Exchange Online will defer the message and surface the error "UntrustedRoot".
Describe The Request
Disabling downloading of certificates may be one cause to this issue. Can this be detected and surfaced in health checker? Can we detect if exchange is using a certificate that does not have the full chain installed in certificate store?
Additional context
Add any other context or screenshots about the feature request here.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.