Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This may be a really stupid question, but I can't seem to put my head around it. I have a mail server I'm trying to setup to service 6 domains. I will have multiple mail users accessing the server via POP3S or IMAPS.

Currently in MS Outlook, they are receiving an unverified SSL cert warning because I'm using a self-signed SSL certificate. I would like to purchase a SSL cert which would stop this warning from appearing.

Here is my question. I want each domain group to use something like mail.theirdomain.com as the incoming mail server name. Is there a way to do this without having to purchase a cert for each of the 6 domains? In other words, can I buy one for the mail.maindomain.com and have it authenticate the other DNS names?

Currently in DNS, the mail.theirdomain.com has a CNAME setup to mail.maindomain.com. I'm running Dovecot for incoming and Sendmail for outgoing. Latest version on Debian 6.

share|improve this question
    
I am pretty sure it would be technically possible to have a single SSL certificate using SubjectAltNames be valid for all the domains, which you could self sign. I don't believe registrars would issue a certificate like that though. Most of them will only permit a single top level domain in a cert with lots of alternate names. –  Zoredache Aug 16 '13 at 23:28
    
A solution might be not to use domains, but subdomains, in other words s1.example.com will be dedicated for a.com, s2.example.com for b.com –  Fischer Aug 16 '13 at 23:31
add comment

2 Answers

up vote 1 down vote accepted

I have used multiple domain certificates, but only in cases where the names are variant domains the same organization. Ownership of the names trace back to the same corporation. If I were a certificate authority, I would not want to provide the same service for unrelated organizations.

For SMTP, it is not unusual for the domain of the mail server to be different than the domain which is originating mail. Dovecot supports domain logins, so that you have have users log in with ids like John.Doe@example.com while using a single domain for the Dovecot server. You would still just need certificate signed by a recognized certificate authority.

You could also do as I do, and publish the public key of your signing certificate. Your clients could then import the key, and the certificate will pass if the domain matches. I haven't tried adding alternate names to a self-signed certificate, but it appears that openssl will generate such certificates fairly easily.

share|improve this answer
    
After much thought, I went ahead a just did a general mail.mydomain.com for SSL related purposes but also setup cnames on the client domains back to the mail server address. After pricing a SAN vs wildcard vs individual, it just made more sense. –  ThaKidd Aug 18 '13 at 0:58
add comment

I agree with BillThor's answer. You may secure your all 6 domains with single SAN (Multi Domain) SSL Certificate. GeoTrust True BusinessID Multi Domain Certificate would be the best choice for you.

If you use self-sign certificate to secure your server, your server may be vulnerable due to many online online attacks like eaves dropping, Identity theft, False messaging, Mail Modification etc. So it is beneficial for you to go for SAN Certificate issued by Trusted CA.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.