Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We currently use secure OWA at our Exchange but also unsecure and unencrypted SMTP, POP3 and IMAP. We have those mapped to smtp.domain.com, pop.domain.com and imap.domain.com while for OWA@IIS we use publicly trusted certificate which was issued for secured.domain.com. I know one solution is to acquire one certificate for multiple domains. But what if that was not an option? How could I go implementing TLS on classic mail services like SMTP, POP and IMAP without universal certificate? I also want to keep aliases smtp, pop and imap in our DNS to not break users access to those services. So we should somehow redirect from, for instance, smtp.domain.com to secured.domain.com.

share|improve this question
    
how many users? I have some ideas, but that's going to affect suggested solutions... also, you said one cert for a number of domains may not be an option, that includes UC and wildcard certs correct? –  Malnizzle Feb 20 '10 at 23:54
add comment

1 Answer

Exchange can generate its own self-signed certificates for these services. They should work tolerably well for TLS (though some TLS peers may reject self-signed certs), and depending on your user base this may work for POP and IMAP as well.

It would overall be simpler, though, to generate a certificate with the proper SANs for the services you want to offer. If you can explain why that may not be an option it would help us come up with a better solution.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.