New answers tagged sni
According to this report https://code.google.com/p/android/issues/detail?id=35050 your problem could also arise from a bug in Androids implementation of the libcore/luni/src/main/java/libcore/net/http/HttpConnection.java. Due to this bug the SNI at the TLS layer is the hostname of the proxy instead of the hostname provided in the HTTP request URL it should ...
If you want to serve smtp/imap for subdomains then one dedicated subdomain is preferrable. IMHO you even shouldn't split your services into two or more separate subdomains like smtp.example.com and pop.example.com. Just use mail.example.com that can be used for smtp/pop/imap and even http if you plan to launch some webmail.
Or I should just use one domain to simplify it like mail.example.com for sending and receiving? Yes, I would advise it. In fact Google Apps using the same technique to handle the thousands domains pointing on it. Google Apps customer must setting his MX record to ASPMX.L.GOOGLE.COM (and friends). All users also use smtp.gmail.com and imap.gmail.com ...
Certificate validation will be done by the client. Use of wildcards is defined for POP, IMAP and SMTP, so a wildcard certificate should fit. But it might be that some older clients have problems, because the details for certificate handling in SMTP were only defined much later then for the other protocols so some old clients might not expect wildcards.
One thing I didn't mention was that I am using the IIS Centralized Certificate Store - which turned out to be important. For my sites let's pretend they're the following groups (the IP is internal and mapped through the firewall). Group A : red.com, blue.com, green.com (UCC certificate A) 10.0.0.1 Group B : cat.com, dog.com, mouse.com (UCC ...
Top 50 recent answers are included