<profile_name>

Enter the name of the TLS profile.

level {none | preferred | secure}

Enter the security level of the TLS connection.

• none: Disables TLS. Requests for a TLS connection will be ignored.

• preferred: Allow a simple TLS connection, but do not require it. Data is not encrypted, nor is the identity of the server validated with a certificate.

• secure: Requires a certificate-authenticated TLS connection. CA certificates must be installed on the FortiMail unit before they can be used for secure TLS connections. For information on installing CA certificates, see the FortiMail Administration Guide.

action {fail | tempfail}

Select the action the FortiMail unit takes when a TLS connection cannot be established.

This option does not apply if level is preferred.

ca-name <ca_name>

Enter the name of the CA issuer.

This option is only available when level is set to secure.

cert-subject <subject_str>

Enter the certification subject.

This option is only available when level is set to secure.

check-ca-name {enable | disable}

Enable to check the CA issuer name.

This option is only available when level is set to secure.

check-ca-type {match | substring | wildcard}

Select a CA issuer check type.

This option is only available when level is secure.

check-cert-subject {enable | disable}

Enable to check the certificate subject name.

This option is only available when level is secure.

check-cert-type {match | substring | wildcard}

Select a certificate check type.

This option is only available when level is secure.

check-encryption-strength {enable | disable}

Enable to check encryption key length.

check-ssl-version {enable | disable}

Enable to check the SSL/TLS version.

Also configure min-ssl-version {ssl3 | tls1_0 | tls1_1 | tls1_2 | tls1_3}.

dane-support {mandatory | none | opportunistic}

Assign a DNS-based Authentication of Named Entities (DANE) support level.

Note: mandatory is only applicable when level is secure.

For more information, see RFC 7929.

encryption-strength <bits_int>

Enter the encryption key length.

min-ssl-version {ssl3 | tls1_0 | tls1_1 | tls1_2 | tls1_3}

Enter the minimum required SSL/TLS version.

This option is only available when check-ssl-version is enable.