1

I would like to publish non-self-signed SSL certificates for some linux mail servers, which operate SSL and/or TLS mail services. (If relevant, these are dovecot+sendmail servers.)

I need to cover the usual {mail,smtp,smtp2,imap,pop3,...}@dom.ain server names, so naturally I thought of purchasing a wildcard *@dom.ain. (UC seeming unnecessary, they all stem from the same dom.ain name)

I have done that already for websites with few or no issues, but I would like to know if mail usage is any different - from a client perspective - since the main objective is avoiding issues with client software complaining about self-.signed certs.

Cheers, alf

1 Answer 1

2

A wildcard cert should be fine! Client issues are very rare. Just make sure you include the whole cert chain (intermediate certs) to avoid issues with older hw / mobile phones.

Setup depends on the mailserver but I can't remember any compatibility issues or the like. Setting up SSL with Dovecot is fairly straightforward and so do most MTAs. Postfix and Dovecot work pretty well and even with good old sendmail I won't expect serious issues.

Also keep in mind to select a good cipher suite. Unless your organisation's guidelines cover that you might find www.bettercrypto.org helpful.

1
  • Yes, wildcard should work in most cases, but still I prefer buying certificates with Subject Alternate Names (SANs) — CAs usually give a chance to add up to ten FQDNs to the wildcard cert.
    – minaev
    Oct 16, 2014 at 12:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .