Does qmail-pop3s supports multiple SSL certificates?

Question

Current setup:
1. I work for E-mail service provider company.
2. We have multiple mail servers on which we use qmail for mail delivery.
3. Each server is hosting multiple different domains for multiple clients.
4. Each server works individually.
5. End users are using qmail-pop service to fetch mails from server and qmail-smtp service to send mails.
6. Each client use there own URL to connect to the server.
For example Mithi Software will use mailxf.mithi.com which is pointing to on of our mail server.

Requirement:
I want to enable qmail-pop3s service for end user so that they can connect to server over secure channel.

Challenge:
As per my knowledge qmail-pop3s service accepts only single SSL certificate. As we have multiple clients hosted on single server and each client provides there own certificate. I want to use all these certificate so that all client can access POPS service.

Expected Result:
Our all clients should be able to access qmail-pop3s service over secure channel with there separate URLs(CN in SSL certificates).

Answer 1

What you're looking for is called Server Name Indication, which is defined in rfc3546 section 3.1.

I don't believe qmail supports SNI. However, it may if it's compiled against and appropriate TLS library. The mail client will also have to support SNI. I don't know of any that do, but this isn't something I've looked into before.

---

Using a wildcard certificate will work if all names are expected to be a subdomain of your domain. That is mail-company1.example.com, mail-company2.example.com, sntp-company1.example.com, etc.

Answer 2

Don't think that this is quite possible. The mail server or pop3d in this case cannot really know in advance what particular domain the user is connecting to so as to choose the appropriate certificate for that single communication.

Since it is impossible to use a single certificate one idea would be to set up multiple pop3d instances each for each client each listening to a different port (995,996 etc) so that each can have its own SSL certificate assigned to it.