SMTP 客户端如何确定是使用显式还是隐式 SSL
大多数支持 SSL/TLS 的邮件客户端仅要求用户说明是否应启用 SSL。 用户不必了解有关 Explicit & 的任何信息。 隐式 SSL 以及它们之间的区别。
那么，邮件客户端如何确定使用哪种类型的 SSL？ 是否基于默认端口号？ 它只是尝试其中一种然后再尝试另一种吗？
Most mail clients that support SSL/TLS only require the user to say whether or not SSL should be enabled. The user doesn't have to know anything about Explicit & Implicit SSL and the differences between them.
So, how does the mail client determine which type of SSL to use? Is it based on default port numbers? Does it just try one and then the other?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
邮件客户端在连接时必须知道是否正在使用隐式 SSL，因为它负责使用
ClientHello消息启动 SSL 握手。 如何确定这一点取决于客户。 端口号是一个很好的提示，但某些 UI 中也可能有一个复选框，即使使用标准（未受保护）端口号也会强制执行此操作。IANA 注册了用于安全邮件的端口号，但某些 ISP 可能会使用其他端口。
SMTP/SSL 通常在端口 465 上提供，但这未注册，并且不太常见，因为 SMTP 代理广泛支持对显式 SSL 的支持。
服务器可以使用特定于协议的协商来通告对显式 SSL 的支持。 例如，当客户端连接到 SMTP 服务器并发出 EHLO 命令时，服务器将列出其功能，其中可能包括对 STARTTLS 命令的支持。
A mail client must know if implicit SSL is in use when it connects, as it is responsible for initiating the SSL handshake with a
ClientHellomessage. How it determines this is up to the client. Port numbers are a great hint, but there could also be a check box in some UI that forces it even when the standard (unprotected) port number is used.There are IANA registered port numbers for secure mail, but some ISPs may use other ports.
SMTP/SSL is often offered on port 465, but this is not registered, and is less common since support for explicit SSL is widely supported by SMTP agents.
Support for explicit SSL can be advertised by a server using a protocol-specific negotiation. For example, when a client connects to an SMTP server, and issues the EHLO command, the server will list its capabilities, which might include support for the STARTTLS command.
端口 465 在商业邮件服务器中非常常见，并且使用非常频繁。 最常用于隐式 SSL。 当您远程登录到此端口时，您将遇到超时，因为您必须先设置 SSL 连接，然后才能与邮件服务器通信。 因此，超时可能是您拥有隐式 SSL 连接的第一个线索。 您无法使用 EHLO 返回结果，因为不允许除 SSL 连接之外的任何连接。 不，您不只是连接到运行隐式 SSL 的 SMTP 服务器，它不会响应，只会断开连接。 这就是它应该做的。 显式 SSL 将首先允许连接，然后再设置 SSL。 是的，隐式 SSL 经常被使用。 缺点是 RFC 标准没有具体说明如何实现，因此不同的开发人员以不同的方式设置它，尽管隐式 SSL 被一些人认为已被贬低。
Port 465 is very common among commercial mail servers and is used very often. Most often it used for implicit SSL. When you telnet to this port you will get a timeout since you must set up the SSL connection first before communications with the mail server. Thus a timeout may be the first clue you have an implicit SSL connection. You cannot use EHLO to return results because no connection other than an SSL connection is allowed. AND NO you do not simply connect to an SMTP server running implicit SSL it will not respond and will just drop the connection. That is what it is supposed to do. Explicit SSL will allow connection first and then set up SSL. AND yes implicit SSL is used often. The drawback is that the RFC standards are not specific as to how it is implemented so different developers set it up in varying ways, even though implicit SSL is considered by some as depreciated.
我相信大多数支持 SMTP over SSL 的客户端都是从未加密的连接开始并发出 EHLO 而不是 HELO。 前者有额外的标志响应，其中之一指示服务器是否支持 STARTTLS 命令。 如果这样做，则客户端可以使用 STARTTLS，然后从那时起使用 SSL。
例子：
I believe most clients that support SMTP over SSL start out with an unencrypted connection and issue an EHLO rather than HELO. The former has extra flag responses, one of which indicates whether the server supports the STARTTLS command or not. If they do, then the client can use STARTTLS, and then use SSL from that point on.
Example: