Configure SMTP on iSeries for Google Apps

[Jason Holtzman]

I've been racking my brain on how to set up SMTP on our iSeries basically as a mailhub (or relay)... I simply want to be able to send email notifications from our ERP system (Infor XA).

A little background: We have one iSeries running Infor XA 9.1 and the OS is at V6R1. Our local domain is just that - it's not accessible from the internet. For our public domain, we have our email hosted off-site by Google Apps. Generally when sending from a Windows client, we just send email authenticating through SSL/TLS (port 587). I'd like to do the same thing from the iSeries. I don't need to receive email at all and I only need to send email from our public domain (through Google Apps). I know with V6R1 you can authenticate with another SMTP server through SSL/TLS, but not sure if I have everything setup correctly.

I've read other posts about security certificates, but it doesn't really make a lot of sense to me. Do I need to create a local certificate authority or do I need to import the ones from Google?

Actually, if someone can just give me a step-by-step on what needs to be done that would be greatly appreciated...

[Dave Wise]

If you have ibm software support, simply call 1-800-IBM-SERV and they will take you through the steps. It's not that hard, but too hard for me to recall how we did it here.

[Jason Holtzman]

I got it working with the help of IBM support. For those interested, here are a few things that weren't exactly straight forward plus some issues we ran into:

1) We had to import Google's CA certificates into DCM using OpenSSL. More info can be found here: http://docs.bvstools.com/home/ssl-documentation.
2) The SMTP client has to trust these CA certificates you imported.
3) We had to create a certificate for the local iSeries (signed by the Local Certificate Authority) and assign that certificate to the SMTP Client. Not sure why we had to do this, but it didn't work until I did this...
4) The iSeries SMTP client is hard-coded for port 25. Luckily, Google Apps allows SSL through port 25 using smtp.gmail.com.
5) If you choose to NOT use SSL, you can still use Google SMTP servers as your relay but you'll have to use aspmx.l.google.com. Make sure to turn off all authentication in the SMTP settings to turn off SSL. You'll probably have to add an SPF record for your domain to allow the IP address of your iSeries (or firewall).
6) Even after I thought we had everything setup correctly, I noticed Google was denying our username/password in the SMTP client trace file even though it was entered correctly. The issue was resolved with the help of this link: https://support.google.com/mail/answer/14257?hl=en

[Dave Wise]

the process differs dramatically based on what version of the iseries OS you're running

[Jason Holtzman]

That's certainly true. SSL authentication through SMTP was not available before V6R1. I'm sure some of the other settings have changed as well. This was just a list of issues I personally ran into. Maybe one or two can help someone in the future.