Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We currently use secure OWA at our Exchange but also unsecure and unencrypted SMTP, POP3 and IMAP. We have those mapped to, and while for OWA@IIS we use publicly trusted certificate which was issued for I know one solution is to acquire one certificate for multiple domains. But what if that was not an option? How could I go implementing TLS on classic mail services like SMTP, POP and IMAP without universal certificate? I also want to keep aliases smtp, pop and imap in our DNS to not break users access to those services. So we should somehow redirect from, for instance, to

share|improve this question
how many users? I have some ideas, but that's going to affect suggested solutions... also, you said one cert for a number of domains may not be an option, that includes UC and wildcard certs correct? – Malnizzle Feb 20 '10 at 23:54

Exchange can generate its own self-signed certificates for these services. They should work tolerably well for TLS (though some TLS peers may reject self-signed certs), and depending on your user base this may work for POP and IMAP as well.

It would overall be simpler, though, to generate a certificate with the proper SANs for the services you want to offer. If you can explain why that may not be an option it would help us come up with a better solution.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.