MSExchangeTransport 11021

This article provides an explanation and possible resolutions for a specific Exchange event. If you don't find what you’re looking for here, try searching Exchange 2010 Help.

Details

Explanation

This event indicates that the Microsoft Exchange Transport service cannot establish a TLS connection to a remote mail server over a Receive or Send connector.

In this scenario, Microsoft Exchange Server 2010 is configured to use Transport Layer Security to send or receive messages to or from the specified domain. However, a configuration issue prevents the encrypted session from being established.

Exchange 2010 includes improvements to the management of TLS. TLS lets an administrator configure an encrypted channel over which to communicate with other messaging servers. Additionally, this protocol lets a server authenticate connections before messages can be sent. For more information, see the following topics:

• Understanding Transport Pipeline

• TLS Functionality and Related Terminology in Exchange 2010

• Understanding TLS Certificates

• Understanding Receive Connectors

User Action

To troubleshoot this issue, do one or more of the following:

• Review the Application log and System log on your Exchange 2010 servers for related events. For example, events that occur immediately before and after this event may provide more information about the root cause of this error.

• Review the Operations Console in Operations Manager for detailed information about the cause of this problem. For more information, see the "Introduction" section in this article.

• Examine the installed certificates to verify that the common name is correct. To view the certificates, follow these steps:

  1. Click Start, click Run, type mmc, and then click OK.

  2. On the File menu, click Add/Remove Snap-in.

  3. Click Certificates, click Add, click Computer account, click Next, and then click Finish.

  4. Click OK.

  5. Expand Certificates (Local Computer), expand Personal, and then click Certificates.

  6. In the details pane, view the certificate details to verify that the certificate reflects the publicly-accessible FQDN that is used to access the server.

  For more information, see Understanding TLS Certificates.

• Verify that the send connector that is used to send mail to the particular domain has TLS enabled. To do this, follow these steps:

  1. Start the Exchange Management Console, and then locate the Transport server that hosts the affected connector.

  2. On the Send Connectors tab, right-click the specified connector, and then click Properties.

  3. Click the Network tab, and then verify that the Enable Domain Security (Mutual Auth TLS) check box is selected.

  4. Restart the Microsoft Exchange Transport service.

• Verify that the Receive connector that receives mail from the particular domain has partner authentication enabled. To do this, follow these steps:

  1. Start the Exchange Management Console, and then locate the Transport server that hosts the affected connector.

  2. On the Receive Connectors tab, right-click the specified connector, and then click Properties.

  3. Click the Authentication tab, and then verify that the Transport Layer Security (TLS) and Enable Domain Security (Mutual Auth TLS) check boxes are selected.

  4. Restart the Microsoft Exchange Transport service.

• Resolve your issue by using self-support options, assisted support options, and other resources. You can access these resources from the Exchange Server Solutions Center. From this page, click Self-Support Options in the navigation pane to use self-help options. Self-help options include searching the Microsoft Knowledge Base, posting a question at the Exchange Server forums, and other methods. Alternatively, in the navigation pane, you can click Assisted Support Options to contact a Microsoft support professional. Because your organization may have a specific procedure for directly contacting Microsoft Product Support Services, be sure to review your organization's guidelines first.

For more information about how to configure TLS, see the following topics:

• Using Domain Security: Configuring Mutual TLS

• Configuring TLS and SSL for POP3 and IMAP4 Access