Validation Authority Successfully Passes Identrus Specifications and Inter-operability Requirements

Redwood City, CA – August 24, 2004 – Tumbleweed® Communications Corp. (NASDAQ:TMWD), a leading provider of secure Internet messaging software and hardware to enterprises and government agencies, today announced the Tumbleweed Valicert Validation Authority™ (VA) has been certified by Identrus, the World's Leading Global Trust Network, and found compliant with the new Identrus™ 3.0 specifications and interoperability requirements.

Comprised of more than 55 financial institutions in over 160 countries, Identrus has established an open standards-based, interoperable infrastructure designed to ensure that companies know who is accessing their data, services and systems. The Tumbleweed Valicert Validation Authority is the single most widely deployed validation solution in the Identrus community. Additionally, the Tumbleweed Valicert Validation Authority is used to run the Identrus Root responder, which offers validation services for Identrus issued digital certificates.

“Tumbleweed Valicert VA release 4.6.x offers a tremendous advantage for Identrus member institutions who upgrade to it” said Clay Epstein VP for Product and Technology for Identrus. “Tumbleweed has embraced the emerging international security standards including the latest Internet Engineering Task Force (IETF) specifications for OCSP, TLS, and delta CRLs. Additionally, this recent release provides better performance and support for network attached hardware signing modules, a critical feature for many of our members. The enhanced secure audit logging and CRL archiving, coupled with robust server monitoring, provide a more secure and easier to manage solution. We strongly encourage all Identrus members to upgrade to Tumbleweed Valicert VA release 4.6.x.”

The most recent Identrus™ 3.0 certified VA release offers a scalable architecture that can address the high-performance, high-availability requirements of Identrus member institutions in the following ways:

• Identrus Compliant OCSP responder and validation solution
• Identrus enabled plug-ins to desktop applications like Internet Explorer, Outlook, and Outlook Express
• Identrus enabled plug-ins to server applications like Internet Information Server (IIS), Apache, Netscape and iPlanet web servers
• Validator toolkits used by relying party applications to Identrus-enable custom applications

“Banking and financial services customers face many new security threats including “phishing,” a new form of email fraud. Strong authentication infrastructures, like Identrus, can be a ready-aid to banks in preventing fraud and developing new services for customers,” said Dave Jevans, Chief Marketing Officer for Tumbleweed Communications.

About the Tumbleweed Valicert Validation Authority

Validation Authority (VA) ensures the validity and integrity of highly valued and trusted transactions. Validation Authority is a Certificate Authority (CA) neutral, extensible server that utilizes multiple validation protocols for checking the validity of X.509 certificates within Public Key (PKI) environments.

Validation Authority delivers a comprehensive, scalable, and reliable framework for validating digital certificates in real time. Validation Authority can validate a certificate issued by any CA.
The Validation Authority is the:

• Recognized leader in the field and is deployed at the majority of Identrus member banks
• Most widely deployed OCSP responder in the US Department of Defense PKI.

In addition to the Valicert Validation Authority, Tumbleweed also offers a suite of plug-in applications to simplify certificate validation processing at the application level. Server Validator (SV) is a plug-in for the most widely used Secure Web Servers on multiple OS platforms. Desktop Validator (DV) is a Microsoft OS based plug-in that provides highly flexible validation options for Microsoft Windows based applications.

About Tumbleweed Communications Corp.
Tumbleweed is a leading provider of secure Internet messaging software and appliances for enterprises and government agencies. By making Internet communications secure, reliable and automated, Tumbleweed's email firewall, secure file transfer, secure email, and identity validation solutions help customers significantly reduce the cost of doing business. Tumbleweed products are used by millions of end-users and tens of thousands of corporations. Tumbleweed customers include ABN Amro, Bank of America Securities, Catholic Healthcare West, JP Morgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), St. Luke's Episcopal Healthcare System, the US Food and Drug Administration, and the US Navy and Marine Corps. Tumbleweed Communications was founded in 1993 and is headquartered in Redwood City, Calif. For additional information about Tumbleweed, go to www.tumbleweed.com or call 650-216-2000.

About Identrus
Identrus™ is a global solutions company that secures interactions where identity is critical. As the only government regulated, bank-built identity company, Identrus provides a worldwide network for trusted identity credentials based on global standards. Identrus’ proven solutions provide a legally and technologically interoperable environment for using identities. The Identrus platform provides the legal and technical infrastructure for financial institutions, governments and commercial entities to effectively manage the risks associated with identity authentication and enable these organizations to develop business applications and value-added services for their customers. Identrus partners with systems integrators, software developers, smart card and token providers, as well as experts on identity management, security and fraud to help organizations achieve greater application security and meet their e-business objectives. Identrus membership consists of more than 55 of the world's leading financial institutions spanning 160 countries. Additional information about the company is available at www.identrus.com.

SAFE HARBOR STATEMENT
Tumbleweed cautions that forward-looking statements contained in this press release are based on current plans and expectations, and that a number of factors could cause the actual results to differ materially from the guidance given at this time. These factors are described in the Safe Harbor statement below.
Except for the historical information contained herein, the matters discussed in this press release may constitute forward-looking statements that involve risks and uncertainties that could cause actual results to differ materially from those projected, particularly with respect to the usage, features, and performance of Tumbleweed’s Valicert Validation Authority products. In some cases, forward-looking statements can be identified by terminology such as "may," "will," "should," "potential," "continue," "expects," "anticipates," "intends," "plans," "believes," "estimates," and similar expressions. For further cautions about the risks of investing in Tumbleweed, we refer you to the documents Tumbleweed files from time to time with the Securities and Exchange Commission, particularly Tumbleweed's Form 10-K filed March 15, 2004, Form 10-Q filed May 10, 2004, and Form 10-Q filed August 12, 2004.

Tumbleweed assumes no obligation to update information contained in this press release, which represents the company's expectations only as of the date of this release and should not be viewed as a statement about the company's expectations after such date. Although this release may remain available on either company's website or elsewhere, its continued availability does not indicate that either company is reaffirming or confirming any of the information contained herein.

Identrus PR Contacts:

Schwartz Communications, Inc.
Nate Hermes or Stephanie Campbell
415-512-0770
identrus@schwartz-pr.com

Identrus
Debbie Fugate – Identrus
415-848-2537
debbie.fugate@identrus.com