Viewing Thread:
"How does SSL work with Freeola EmailPro?"

Considering using SSL authentication with Freeola EmailPro, and wondered if anyone can tell me...

1) the benefits of using SSL for email?
and
2) how it works on the Freeola mail servers?

As I understand it...

My email program contacts the Freeola mail server, which then responds with its SSL Certificate
- how does my email program know whether to trust the SSL Certificate received?

Assuming my email program trusts the SSL Certificate, I'm then authenticated by Freeola's mail server by my username and password
- are these credentials encrypted, or clear-text?

Once authenticated
- which encryption method (if any) is used to transmit my email message?

Sorry if these are basic questions, but I'd really like to get a handle on whether to push forward with EmailPro and SSL.

Thanks in advance for any advice.

Kenny

Ah you meant the webmail login, not the actual webmail services themselves (webmail.freeola.com etc) they have always been HTTPS.

Hi Eccles,
I'm not sure you're right on HTTPS for webmail *always* being place! But glad it is now :¬)

In MyFreeola things still read like this:

"Accessing Webmail without MyFreeola
The Webmail Login Page is useful if you have more than one person's address on your account and you want to enable them to access their own email address with the email address & password, but do not want to allow them access to all the email addresses in your MyFreeola account.

http://freeola.com/webmail" *** <<<<< ! ***

I'll have to investigate the 'standard' email also being able to use SSL/TLS now - perhaps you could arrange for the docs to be updated?

Thanks.
[s]Hmmm...[/s]

EDIT: On my browser/eyes(!) it doesn't look like the forum Bold tags are working. I've tried upper and lower - but not a mix as in your example ;)



Post edited by Hmmm... on 08/03/2018 at 17:51.

Webmail (both versions) have always been served over HTTPS.
You should be able to connect to the free email service using SSL/TLS as well.

Hi Eccles,
I see both standard and 'pro' webmail are now using HTTPS.

Looking at your email client setup guides it looks like only emailpro is able to use SSL/TLS - is that still the case?

If it is, are there any plans to change this as more and more services are now using SSL/TLS?

Thanks.
[s]Hmmm...[/s]

Yes, like most email services only the credential/authentication is encrypted. Once mail leaves our servers its content is not encrypted. To do this you would be looking at something like OpenGPG, which a lot of clients support.

As for the level of encryption, this depends more on the client. We support most popular encryption algorithms and the servers will present them to your client in order of security, so it will try and get your client to use the most secure algorithm first, with fallback to older ones (this is how SSL browser negotiation works too). I would use TLS and make sure your client is up to date to ensure the best level of encryption.

Thanks for your prompt reply Eccles.

So it's only our login credentials that are encrypted (TLS). Any information on what level of encryption that involves?

Any recommendations on a Freeola compatible product that could assist with encrypting the actual message (and attachments)?

Thanks and regards,

Kenny

Hi MorkenTheMonk,

Hopefully I can answer your questions.

1. Your login credentials are sent encrypted from your mail program to our servers. That is the main benefit.
2. It works as you've described. You mail client checks the certificate with the trusted certificate authority. The certificate our server sends contains info regarding the certificate authority your client should go and check the authenticity with (the client will have a list of known trusted authorities). If the certificate isn't valid (is self-signed or has expired) your client should then warn you. If all is ok then you email credentials are are sent encrypted to our server, usually using TLS.

Server to server transmission of email is not normally encrypted, for that you would be looking at something like PGP email encryption, which encrypts messages end to end and requires the receiver to do PGP decryption.

Considering using SSL authentication with Freeola EmailPro, and wondered if anyone can tell me...

1) the benefits of using SSL for email?
and
2) how it works on the Freeola mail servers?

As I understand it...

My email program contacts the Freeola mail server, which then responds with its SSL Certificate
- how does my email program know whether to trust the SSL Certificate received?

Assuming my email program trusts the SSL Certificate, I'm then authenticated by Freeola's mail server by my username and password
- are these credentials encrypted, or clear-text?

Once authenticated
- which encryption method (if any) is used to transmit my email message?

Sorry if these are basic questions, but I'd really like to get a handle on whether to push forward with EmailPro and SSL.

Thanks in advance for any advice.

Kenny