Securing email
Prerequisites: The EmailService is in your Services container with both IncomingAccount and OutgoingAccount components. If not, add the EmailService component from the email palette before you begin. You may have multiple incoming and outgoing accounts, which allow you to set up connections to
servers that support secure communication and others that may not.
Follow this procedure for both your incoming and outgoing accounts.
Perform the following steps:
- In the station's Nav tree, right-click the IncomingAccount or OutgoingAccount node under the EmailService container and click . The account Property Sheet opens.
- As of
Email Authenticator, select the preferred email authentication type (for example, by Microsoft 365/Exchange and Gmail). For more information, see “email-IncomingAccount” and “email-OutgoingAccount” components in the Niagara Alarms Guide. - The system provides two secure communication options:
- The default,
Use Ssl, encrypts the connection before it is ever opened. To do the encryption, it automatically accepts the TLS version that is configured in theTls Min Protocol, using the best TLS level that is supported by both the station and the server. Use Start Tlsmakes it possible to connect to an unprotected email server. The handshake occurs without encryption, then switches to encrypt the message itself.Use SslandUse Start Tlsare mutually exclusive. Both may befalse.- For
Tls Min Protocol, select the minimum acceptable TLS version to use.
- The default,
- To provide secure email, set one property to
true, and the otherfalse.The example shows the configuration when
Transportis set toSmtp.Incoming and outgoing messages use different ports for secure communication as follows:
Email ports based on transport type
Not all servers follow these rules. You may need to check with your ISP (Internet Service Provider).
NOTE: Do not enable or disable theUse SslorUse Start Tlsproperties without configuring thePort. - Change the
Portto the appropriate port number (defaults are: 25 for outgoing and 110 for incoming email).The system also provides server identity verification. For most email servers, the root certificate is already in the System Trust Store. - If no root CA certificate for the email server is in the station's System Trust Store (third-party signed certificate) or in the User Trust Store (your own certificate if you provide your own secure email server), either:
- Import your own or a third-party signed root CA certificate into the station’s User Trust Store.
- Or, if you do not have a signed certificate yet, accept the system-generated, self-signed certificate when challenged. This creates an exemption in the Allowed Hosts list. Later, import the root CA certificate and delete this temporary exemption.