If you are in position that you need multiple SSL certificates for different domains on single mail server, you can do it with SNI. Of corse, on very old versions this is not supported. Check documentation first, if its supported for your version of Dovecot and Postfix.
Dovecot:
In case of incoming mailserver Dovecot it’s easy as listed bellow. I made file ssl-sni.conf in which I add SNI configurations for my domains. Then I included ssl-sni.conf in main dovecot config.
Create ssl-sni.conf and add your SNI definitions in it:
local_name mail.domain1.com {
ssl_cert = </etc/ssl/certs/domain1/fullchain.pem
ssl_key = </etc/ssl/certs/domain1/privkey.pem
}
local_name pop3.domain2.com {
ssl_cert = </etc/ssl/certs/domain2/fullchain.pem
ssl_key = </etc/ssl/certs/domain2/privkey.pem
}
...
Then include this in main dovecot config (you can add those configurations directly in dovecot.conf or 00-ssl.conf also. I just prefer separate this):
# SNI include !include ssl-sni.conf
Postfix:
As for Postfix, configuration is also simple:
Inside /etc/postfix/, create file domain_ssl.map and add ssl definitions in it:
mail.domain1.com /etc/ssl/certs/domain1/privkey.pem /etc/ssl/certs/domain1/fullchain.pem smtp.domain2.net /etc/ssl/certs/domain2/privkey.pem /etc/ssl/certs/domain2/fullchain.pem
Run postmap and restart Postfix:
[root@mail postfix]# postmap -F domain_ssl.map which will create domain_ssl.map.db [root@mail postfix]# systemctl restart postfix
If everything is OK, you should now have SNI supported mail server.
Recent Comments