2

I have a mail server I'm trying to setup to service 6 domains. I will have multiple mail users accessing the server via POP3S or IMAPS.

Currently in MS Outlook, they are receiving an unverified SSL cert warning because I'm using a self-signed SSL certificate. I would like to purchase a SSL cert which would stop this warning from appearing.

I want each domain group to use something like mail.theirdomain.com as the incoming mail server name. Is there a way to do this without having to purchase a cert for each of the 6 domains? In other words, can I buy one for the mail.maindomain.com and have it authenticate the other DNS names?

Currently in DNS, the mail.theirdomain.com has a CNAME setup to mail.maindomain.com. I'm running Dovecot for incoming and Sendmail for outgoing. Latest version on Debian 6.

Improve this question
2
  • I am pretty sure it would be technically possible to have a single SSL certificate using SubjectAltNames be valid for all the domains, which you could self sign. I don't believe registrars would issue a certificate like that though. Most of them will only permit a single top level domain in a cert with lots of alternate names.
    – Zoredache
    Aug 16, 2013 at 23:28
  • A solution might be not to use domains, but subdomains, in other words s1.example.com will be dedicated for a.com, s2.example.com for b.com
    – Lynob
    Aug 16, 2013 at 23:31

2 Answers 2

Reset to default
1

I have used multiple domain certificates, but only in cases where the names are variant domains the same organization. Ownership of the names trace back to the same corporation. If I were a certificate authority, I would not want to provide the same service for unrelated organizations.

For SMTP, it is not unusual for the domain of the mail server to be different than the domain which is originating mail. Dovecot supports domain logins, so that you have have users log in with ids like [email protected] while using a single domain for the Dovecot server. You would still just need certificate signed by a recognized certificate authority.

You could also do as I do, and publish the public key of your signing certificate. Your clients could then import the key, and the certificate will pass if the domain matches. I haven't tried adding alternate names to a self-signed certificate, but it appears that openssl will generate such certificates fairly easily.

Improve this answer
1
  • After much thought, I went ahead a just did a general mail.mydomain.com for SSL related purposes but also setup cnames on the client domains back to the mail server address. After pricing a SAN vs wildcard vs individual, it just made more sense.
    – ThaKidd KG5ORD
    Aug 18, 2013 at 0:58
1

I agree with BillThor's answer. You may secure your all 6 domains with single SAN (Multi Domain) SSL Certificate. GeoTrust True BusinessID Multi Domain Certificate would be the best choice for you.

If you use self-sign certificate to secure your server, your server may be vulnerable due to many online online attacks like eaves dropping, Identity theft, False messaging, Mail Modification etc. So it is beneficial for you to go for SAN Certificate issued by Trusted CA.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .