SMTP authentication requires TLS
A profile that turns on Authentication required must use TLS for Connection security. BigFix UI rejects the combination of authentication and an unencrypted connection, because credentials must never travel in cleartext.
The limitation
SMTP authentication sends a user name and password to the mail server. On an unencrypted connection, those credentials cross the network in cleartext, where anyone on the path can read them. For this reason, BigFix UI does not support a profile that sets Authentication required to on and Connection security to None.
The limitation is a security rule, not a defect. There is no setting that turns it off. If your mail server accepts credentials only on an unencrypted port, ask your mail administrator to enable TLS on the server, or configure the profile for unauthenticated relay instead.
How BigFix UI handles it
BigFix UI enforces the rule in the profile form and again in the backend, so an unsupported profile cannot be saved.
- The form flags the combination
- If you turn Authentication required on and leave Connection security set to None, the Connection security field turns red and shows the message Select TLS when authentication is enabled. Change Connection security to TLS to clear the message.
- The backend blocks the save
- The backend applies the same rule when it receives the profile, so the combination is rejected even if the form is bypassed. A profile that pairs authentication with an unencrypted connection never reaches storage.
- The mail server certificate must be trusted
- When a profile uses TLS, the certificate that the mail server presents must be trusted by the machine certificate store on the BigFix UI server. Self-signed certificates and certificates from an internal certificate authority fail the connection test until someone adds them to that store. Ask your administrator to import the certificate, and then run the test again.
- Port 465 always requires TLS
- Port 465 is an implicit TLS port. A profile that uses port 465 must set Connection security to TLS, whether or not Authentication required is on.
What to do
- To authenticate to the mail server, select TLS and enter a port that accepts an encrypted connection, such as 465.
- To relay mail without credentials on an unencrypted port, turn Authentication required off. BigFix UI then hides Username and Password, and None is a valid connection security.
- If the connection test fails after you select TLS, check that the mail server certificate is in the machine certificate store on the BigFix UI server.