You're viewing the mstdn.social public feed.

Federated feed Local feed

Thomas Pikethomasp@vivaldi.net
Jun 19, 2026, 10:41 PM
So, seems like Microsoft's *.olc.protection.outlook.com mail servers are currently using certificates signed by an distrusted root CA[1].
That seems like a shocking level of incompetence.
It means that any mail server supporting MTA-STS is currently unable to deliver any mail to them.
[1] DigiCert Global Root CA which has been scheduled for distrusting since 2023 https://knowledge.digicert.com/general-information/digicert-root-and-intermediate-ca-certificate-updates-2023
💬 6🔄 30⭐ 9

Replies

Thomas Pikethomasp@vivaldi.net
Jun 19, 2026, 10:42 PM
I don't suppose anyone here knows the best way to notify them of this problem? Anyone with contacts at Microsoft?
💬 1🔄 2⭐ 1
Thomas Pikethomasp@vivaldi.net
Jun 19, 2026, 10:44 PM
Affected recipient domains include hotmail.com, live.com and outlook.com, but also various other customer domains, eg. deutschebahn.com
💬 0🔄 0⭐ 1
Thomas Pikethomasp@vivaldi.net
Jun 19, 2026, 10:51 PM
~$ openssl s_client -connect outlook-com.olc.protection.outlook.com:25 -starttls smtp
CONNECTED(00000003)
depth=1 C = US, O = DigiCert Inc, CN = DigiCert Cloud Services CA-1
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = mail.protection.outlook.com
verify return:1
💬 0🔄 0⭐ 0
EricLawEriclaw@mastodon.social
Jun 22, 2026, 7:50 PM
@thomasp The team is aware and working on this. Thanks!
💬 0🔄 1⭐ 0
TechieNotNetieTechieNotNetie@vivaldi.net
Jun 19, 2026, 10:50 PM
@thomasp @Ericlaw @ericlawrence.com
💬 1🔄 0⭐ 1
Thomas Pikethomasp@vivaldi.net
Jun 19, 2026, 10:52 PM
@TechieNotNetie Thank you!
💬 0🔄 0⭐ 0
Jørnjornane@ipv6.social
Jun 20, 2026, 12:58 PM
This would be a fun footnote in RYOM 2nd edition, @mwl
@thomasp
💬 1🔄 0⭐ 0
Michael W Lucas :flan_on_fire:mwl@io.mwl.io
Jun 20, 2026, 1:23 PM
@jornane @thomasp :flan_facepalm:
💬 0🔄 0⭐ 0
Ollivier Robert 🇺🇦😷🌈♾️Keltounet@mastodon.social
Jun 20, 2026, 3:05 PM
@thomasp @mwl
OTOH I'm still convinced MTA-STS is a pile of utter crap.
https://blog.keltia.net/mta-sts-or-the-worst-of-everything-dot-dot-dot/
💬 2🔄 0⭐ 0
Thomas Pikethomasp@vivaldi.net
Jun 20, 2026, 3:14 PM
@Keltounet @mwl Yeah, I've had some annoying issues with MTA-STS on my personal server in the past too, related to the use of CNAMEs: https://thomasp.vivaldi.net/2020/11/22/adventures-with-mta-sts/
💬 1🔄 0⭐ 0
Thomas Pikethomasp@vivaldi.net
Jun 20, 2026, 5:35 PM
@Keltounet That said, this current issue is not a problem with MTA-STS itself. If we were using another method to verify that a TLS connection should be used, it would still fail, because the TLS connection itself is at fault here.
💬 1🔄 0⭐ 0
Ollivier Robert 🇺🇦😷🌈♾️Keltounet@mastodon.social
Jun 20, 2026, 6:41 PM
@thomasp I agree for this specific issue, just that more failure points is not very good.
💬 0🔄 0⭐ 0
🆘Bill Cole 🇺🇦grumpybozo@toad.social
Jun 20, 2026, 5:01 PM
@Keltounet @thomasp @mwl You are correct, sir.
💬 0🔄 0⭐ 0