Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For a beginner, can anyone recommend a good method of setting up a encrypted IMAP server (on port 993) or at least TLS POP3 email ? There are plenty of examples of opportunistic client side email encryption with PGP or FireGPG or Enigmail, but that is not the answer I am looking for because swapping keys is complicated for some users (and it needs to be useable by everyone, not just some)

I would basically like to know how to setup a company of 50 people with encrypted email , using a self-signed company cert, so that they can connect with Thunderbird without any additional configuration necessary.

Or, something a little like the experience you get when connecting to Gmail TLS email using Thunderbird.

A simple pointing in the right direction may get rewarded as an answer.

share|improve this question
What kind of platform do you want your server to run on? – Marie Fischer Jul 9 '09 at 1:55
up vote 2 down vote accepted

I'd do this with Dovecot, although you didn't mention your preferred OS. The configuration is relatively straightforward.

(hint: /etc/dovecot/dovecot.conf, configure protocols, ssl_cert_file, and ssl_key_file).

A couple of caveats that you may already be aware of:

  1. Don't use a self signed cert. Make your own CA and distribute that around, or find a cheapo SSL cert from Comodo or GoDaddy or someone.

  2. This isn't a full-fledged solution like GPG is. pops and imaps only secure the email in transit from your email server to the client. The email will remain in clear text pretty much everywhere else -- while in rest on the server or client, on other people's networks, and printed out. That's not to say this isn't worthwhile, but don't pretend it's all you need to do.

share|improve this answer

It's usually as simple as creating a certificate (either a self-signed one, or buying a SSL certificate from a vendor), pointing your mail server's configuration file at the files containing the certificate and private key, enabling TLS, and optionally setting the mail server to deny logins which aren't using TLS/SSL.

I use Dovecot for IMAP and POP, and the instructions on their wiki are fairly comprehensive.

All I had to add to Debian's default Dovecot configuration to enable TLS was:

ssl_cert_file = /path/to/mail_cert.pem
ssl_key_file = /path/to/mail_privatekey.pem
share|improve this answer

It's going to be very specific to your mailserver of choice. But a couple of additional pointers:

  • IMAPS on port 993 is SSL, rather than TLS. The difference is that SSL negotiates encryption from the off. Whereas TLS negotiates encryption on top of a plaintext channel. One isn't necessarily worse than the other, but it's important to differentiate their behaviour. IMAP is better suited to the former.

  • In addition to securing IMAP you also want to secure mail that your users send to the server. This means placing a restriction that relayed (not to local accounts) messages come in over TLS and additionally they should be authenticated with SMTP AUTH.

  • Lastly, you can opt to relay messages to other public servers using TLS, where they support it. Not all do. But by making the option available you can secure a portion of your outbound mail while it's in transit of the first hop.

share|improve this answer

I always recommend the excellent ISP-style Email Server with Debian-Etch and Postfix 2.3 howto

It describes how to install an SSL/TLS enabled mail server:

  • dovecot, postfix
  • smtp auth
  • user database
  • virtual domains
  • spam filter

As others already said, you need to put some restrictions on inter mail server smtp traffic to enforce encryption for outbound mails.

Afterwards you might want to look into S/MIME to solve the message signing problem at a company level. tinyca should help you get started with creating the key infrastructure.

If you need encrypted storage you could encrypt the hard disks, too.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.