Postfix and Dovecot - setting up TLS encryption for IMAP

Question

I am able to connect to my Dovecot server and read emails. However I am currently doing it using the "PLAIN" password connection. How can I setup postfix and dovecot to use TLS? From what I recall you have to pay for a SSL certificate, is TLS similar or can I do this with some configuration settings minus the money?

Answer 1

There are a couple of alternatives to paying for an SSL certificate:

• You can use a self-signed certificate. This will result in "certificate warnings" for users of the certificate, as it's not signed by a "trusted" CA (they're not very trustworthy anyway), but if you have a small, known set of users, this can be a valid option.
• You can use a free CA: There are a few of these, ranging from "community" CAs such as http://cacert.org/ to commercial CAs that have decided to offer a subset of their services for free, such as http://startssl.com/. This will typically remove the certificate warning (although typically at some degree of hassle; startssl needs an intermediate cert and CAcert's root cert isn't universally trusted), however these free services are typically limited in various ways (CAcert's certs are only valid for 6 months at a time; startssl's free certs are only for personal use).

Either way, once you've got a certificate (and the associated private key), it's a fairly simple matter of setting a few config variables and maybe opening a couple of ports. Rather than rewriting all that here, I'll just point you to the relevant docs:

• SSL information for Dovecot 1.x
• SSL configuration for Dovecot 2.x
• TLS configuration/information for Postfix