Certipost Selects Tumbleweed Valicert Validation Authority for Real-time Certificate Validation.

Business Editors/High-Tech Writers

REDWOOD CITY, Calif.--(BUSINESS WIRE)--April 6, 2004

Leading Electronic Communications Provider Selects Validation

Authority for its Secured Online Postal Services

Tumbleweed(R) Communications Corp. (Nasdaq:TMWD),, a leading provider of secure Internet messaging software and appliances for enterprises and government agencies, today announced that Certipost, a subsidiary of Belgian Post Group and Belgacom, has chosen Tumbleweed's Validation Authority (VA) to reinforce security for MyCertipost, the companies secure electronic mail delivery service.

Certipost is an international provider of electronic communications solutions and will be using Tumbleweed Valicert Validation Authority in the digital certificates used as part of the MyCertipost service. MyCertipost is an electronic delivery platform which enables companies to receive and distribute personal documents, like invoices or wage slips, to closed communities of recipients, such as employees, customers and suppliers, safely and in complete confidence.

Validation Authority will enable Certipost to verify the identity and authorisation of all correspondents communicating electronically, through digital certificates from any approved Certificate Authority (CA). Validation Authority will also significantly reduce the time taken to carry out electronic transactions and provide a more efficient alternative to the traditional certificate revocation list (CRL) system. Validation Authority from Tumbleweed is based on the OCSP protocol which unlike CRL can check the status of certificates in real time.

"We were looking for a more efficient alternative to the CRL download and evaluated a variety of vendors for real-time certificate validation," said Olivier Delos, E-Trust Business Unit Manager at Certipost. "Certipost chose Tumbleweed because of its broad experience in validating certification services, its impressive list of clients, and its expertise in security."

Martyn Richards, Managing Director, EMEA for Tumbleweed Communications, commented: "By choosing Validation Authority, Certipost will be implementing a product that delivers a comprehensive, scalable, and reliable framework for validating certificates. Our relationship with Certipost will provide secure, real-time solutions to the Belgian market and this partnership demonstrates Tumbleweed's strategy to become a key player in the European security field."

About the Tumbleweed Valicert Validation Authority

Validation Authority (VA)

-- Ensures the validity and integrity of highly valued and

trusted transactions.

-- Is a Certificate Authority (CA) neutral, extensible server

that utilizes multiple validation protocols for checking the

validity of X.509 certificates within Public Key (PKI)

environments.

-- Delivers a comprehensive, scalable, and reliable framework for

validating digital certificates in real time and can validate

a certificate issued by any CA.

-- Is the recognized leader in the field and is deployed at the

majority of Identrus member banks

-- Is the most widely deployed OCSP responder in the US

Department of Defense PKI

In addition to the Valicert Validation Authority, Tumbleweed also offers a suite of plug-in applications to simplify certificate validation processing at the application level. Server Validator (SV) is a plug-in for the most widely used Secure Web Servers on multiple OS platforms. Desktop Validator (DV) is a Microsoft OS based plug-in that provides highly flexible validation options for Microsoft Windows based applications.

About Certipost

Certipost provides solutions to facilitate and certify electronic communications and offers organisations high-end solutions to reduce costs and increase efficiency via electronic communications. Certipost enables organisations to communicate electronically with any customer, citizen, supplier and public institution, by automating inbound and outbound information flows, streamlining document exchange and by securing and certifying electronic communications. Furthermore, Certipost is supplier of the digital certificates within the Belgian electronic identity card (eID). Certipost offers solutions enabling electronic invoicing, document exchange within the supply chain, e-government with social security and customs, electronic registered mail, electronic security, electronic counters and the use of the electronic identity card within organisations.

Certipost was founded in 2002 in Belgium as the joint venture of Belgian Post Group and Belgacom, and has over 1.000 cross-industry customers worldwide. The company is headquartered in Brussels (BE) and has offices in Ghent (BE), Amsterdam (NL) and Paris (FR). Certipost is managed by Erik Weytjens, the former CEO of e-Services, a subsidiary of the Belgian Post Group. Jacques Heynen, president of Belgacom's Enterprise Solutions Division, is chairman of the board.

More information on Certipost and its solutions can be found at www.certipost.be.

About Tumbleweed Communications Corp.

Tumbleweed is a leading provider of secure Internet messaging software and appliances for enterprises and government agencies. By making Internet communications secure, reliable and automated, Tumbleweed's email firewall, secure file transfer; secure email, and identity validation solutions help customers significantly reduce the cost of doing business. Tumbleweed products are used by millions of end-users and tens of thousands of corporations. Tumbleweed customers include ABN Amro, Bank of America Securities, Catholic Healthcare West, JP Morgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), St. Luke's Episcopal Healthcare System, the US Food and Drug Administration, and the US Navy and Marine Corps. European customers include ABN Amro, Telewest Communications, Foster Wheeler, KPMG Germany and AP Moeller. Tumbleweed Communications was founded in 1993 and is headquartered in Redwood City, Calif. For additional information about Tumbleweed go to www.tumbleweed.com or call [phone] or [phone].

SAFE HARBOR STATEMENT

Tumbleweed cautions that forward-looking statements contained in this press release are based on current plans and expectations, and that a number of factors could cause the actual results to differ materially from the guidance given at this time. These factors are described in the Safe Harbor statement below.

Except for the historical information contained herein, the matters discussed in this press release may constitute forward-looking statements that involve risks and uncertainties that could cause actual results to differ materially from those projected, particularly with respect to the features and performance of Tumbleweed's Validation Authority product. In some cases, forward-looking statements can be identified by terminology such as "may," "will," "should," "potential," "continue," "expects," "anticipates," "intends," "plans," "believes," "estimates," and similar expressions. For further cautions about the risks of investing in Tumbleweed, we refer you to the documents Tumbleweed files from time to time with the Securities and Exchange Commission, particularly Tumbleweed's Form 10-K filed March 15, 2004.

Tumbleweed assumes no obligation to update information contained in this press release, including for example its guidance regarding its future performance, which represents the Company's expectations only as of the date of this release and should not be viewed as a statement about the Company's expectations after such date. Although this release may remain available on the Company's website or elsewhere, its continued availability does not indicate that the Company is reaffirming or confirming any of the information contained herein.