Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently running a postfix server with self signed certificates serving one mail domain,, the mail server is and so is the CN of the certificate. Now, I need to add a new domain to it. The new domain name is to the same server.

Since the users already have the root of the old certificate, I'd like to reuse that. However, I'd like to issue a new certificate so users using the SMTP from Outlook/Thunderbird of do not get warnings. If I understand correctly, if I issue a new certificate with and a and have postfix serve this, the client will not complain either way about the cn not matching the target host name. Am I correct in this assumption or am I misunderstanding the concept of Subject Alternative Name?

Just to avoid conversation, I do not want to have users on addresses use the server because I might (not a technical issue) have to split up into two different locations, and I want to produce an easily migrateable setup.

share|improve this question

You need to set the subjectAltName to all the DNS (or IP) entries to you want to use. In your case, that would be,

The CN is actually deprecated in the RFC, an can be completely ommited. If it is used, it has to be set to either value of the subjectAltName extension.

NOTE: I am talking about RFC2818 here, which defines HTTP over TLS. But since neither the SMTP nor the generic TLS RFC mention the certificate field to be used for name matching, this is the best bet I am aware of.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.