By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

SES: Update TLS connections to 1.2 to maintain AWS connectivity

0

Goodmorning, i received this email from amazon to update my TLS clients to 1.2: "We have identified TLS 1.0 or TLS 1.1 connections to AWS APIs from your account that must be updated for you to maintain AWS connectivity. Please update your client software as soon as possible to use TLS 1.2 or higher to avoid an availability impact." and they sent me a list of message ID's and IP addresses. We use SES on lot's of services on the same IP address so we don't know what emails are TLS1.0/1.1 Is there any way to log the sender and receiver of the emails mentioned so we can identify the emails?

  • Max Clements EXPERT
    8 months ago

    Is this for inbound SMTP messages, or are you using the API SendRawEmail to send messages?

  • Peter
    8 months ago

    Following.

    Same story here. We've tried CloudWatch / CloudTrail as noted in the docs to get more information, but no TLS data listed in CW/CT. Based on only a message id from the mailed log rows, it's undoable to find the source. In our own case we are sending with the API SendRawEmail.

Topics
Management & GovernanceFront-End Web & MobileBusiness ApplicationsAWS Well-Architected Framework
Tags
Amazon CloudWatchAmazon Simple Email ServiceSecurityAmazon CloudWatch Logs
Language
English
Stephanie
asked 8 months ago2777 views
3 Answers
0

Hi, you should implement what is described in this blog post to identify the faulty TLS clients: https://aws.amazon.com/blogs/mt/using-aws-cloudtrail-lake-to-identify-older-tls-connections-to-aws-service-endpoints/

It is based on CloudTrail Lake and gives you a holistic view on this issue

Best,

Didier

profile pictureAWS
EXPERT
Didier_Durand
answered 8 months ago
  • Peter
    8 months ago

    This only works for management events, not API data events. When sending through the API (SendRawEmail) this doesn’t log the send events.

0

I answered a similar question here: https://repost.aws/questions/QULhXMQHooRye2QtF_xXeQAQ/how-to-see-cloudtrail-of-ses-calls-sendrawemail-re-tls-1-1#ANkYu8ryN7RZeWWJSNvZAJig.

Hope it helps you.

profile picture
Eduardo Balbinot
answered 8 months ago
0

Hi, in our case emails with were sent from java with version TLSv1 and was fixed adding to the code

mail.smtp.ssl.protocols=TLSv1.2

Regarding how to identify the instances where the emails were sent, we followed this guide https://www.netmeister.org/blog/tcpdump-ssl-and-tls.html

In brief, with this tcpdump you'll capture TLSv1 and TLSv1.1 negotiation:

tcpdump "tcp port 587 and (tcp[((tcp[12] & 0xf0) >>2)] = 0x16) && (tcp[((tcp[12] & 0xf0) >>2)+9] = 0x03) && ( (tcp[((tcp[12] & 0xf0) >>2)+10] = 0x01) || (tcp[((tcp[12] & 0xf0) >>2)+10] = 0x02))" -X

and with this tcpdump you'll capture TLSv1.2 negotiation packets

tcpdump "tcp port 587 and (tcp[((tcp[12] & 0xf0) >>2)] = 0x16) && (tcp[((tcp[12] & 0xf0) >>2)+9] = 0x03) && (tcp[((tcp[12] & 0xf0) >>2)+10] = 0x03)"

Regards

egaldu
answered 7 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content