Replying to a message from: James

Thank you for your support and response in helping to understand the procedure however I think there is a slight confusion.

If you are presently using Xeams on your demo lab and have both a certificate installed in exchange and in Xeams please browse to checktls.com and give it a try yourselves. I've attached a snippet below on what exactly is proxied across. Exchange seems to be doing the TLS and not Xeams. 

If you take a closer look you will see that Exchange is in fact explaining to the remote server "we are TLS ready" not Xeams. If you continue further down you will also see the connection is proxied with the AUTH commands and SIZE commands of the exchange server. The exchange server is replying back and serving the certificate through the proxy which is incorrect according to RFC standards.

The proxied connection shows that Exchange is sending its certificate back and not Xeams?
If Xeams was sending the certificate back it would show the external server name with checktls and not the internal exchange server name which I have masked.
If Xeams was setup in SMTP server mode and accepted the email in TLS and restarted another TLS session with Exchange your explanation would make sense.

There is some sort of man in the middle issue going on here. Why does Xeams even need to have a copy of the certificate if it simply relaying the communication down? I can definitely understand if it was running in SMTP server mode but it isn't. A further example of this is in your instructions located here:http://www.xeams.com/using-iis-cert.htm. SSL standards most certainly doesn't even allow exporting a certificate from one server and using it on another server with a different host name, A simple google search will show that. If that was the case you would need a SAN (alternate names) certificate which includes the Xeams server hostname on it. Please can you explain further? 

Can you please try this in your labs as I believe there is definitely an issue with the current setup that Xeams handles mail according to TLS RFC communication?

Please can you explain further?
Thank you for your help guys.

000.105]   Connected to server
[000.380] 220 internal.server.name Microsoft ESMTP MAIL Service ready at Thu, 10 Aug 2017 14:17:07 +0100 - via Xeams-Proxy Version: 5.9 - build: 5934; 10/08/17 14:18
[000.381]   We are allowed to connect
[000.381]  --> EHLO checktls.com
[000.486] 250-internal.server.name Hello [ Proxied ]
250-STARTTLS
250-SIZE xxxx
250-DSN
250-ENHANCEDSTATUSCODES
250-AUTH NTLM
250 OK
[000.487]   We can use this server
[000.487]   TLS is an option on this server
[000.487]  --> STARTTLS
[000.595] 220 Go ahead
[000.595]   STARTTLS command works on this server
[001.038]   SSLVersion in use: TLSv1.2
[001.038]   Cipher in use: ECDHE-RSA-AES128-SHA
[001.038]   Connection converted to SSL