8

As we're aware postfix doesn't support SNI (Server Name Indication), which means that if you'd define a certificate, it will be used for all domain names that you have on that server, which could be bad for people not willing to pay big bucks to purchase fancy certificates. Postfix states on their website that they have no plans to implement SNI.

I have my mail server configured with Dovecot and Postfix. I would like to replace postfix with something that supports SNI and compatible with Dovecot (or at least accepts the same username/password database scheme from Dovecot).

Could you please tell me what alternatives to postfix exist that fulfill these conditions (preferably open source).

9
  • Can you explain the scenario where a single certificate for a single name would not suffice in the context of smtps? I think that scenario is unclear at best and I would assume this is the reason why it's not supported. Nov 27, 2014 at 20:50
  • 1
    Hi, why do you need SNI support for your smtpd? The only thing that needs to match for ssl verification is the CN on the ssl cert matches the banner hostname. SSL certificates are so ridiculously cheap now-a-days (<50 USD/year) I find your argument is hard to accept. Nov 27, 2014 at 20:51
  • Further, your reverse DNS ptr must match your banner hostname for many mail services to not reject you outright as a spammer. Nov 27, 2014 at 21:06
  • 2
    @TheQuantumPhysicist But for smtp w/ TLS the certificate would be for the mail server name, not all domain names that the mail server deals with. Nov 27, 2014 at 21:21
  • 1
    @TheQuantumPhysicist serverfault.com/questions/389413/… seems to cover this subject Nov 27, 2014 at 22:04

1 Answer 1

8

If you already know all the FQDN's you are going to need, buy a SAN-certificate.

If you need to be flexible with you certificates you can try and setup a nginx smtp proxy. I looked at the documentation and from the looks it should support SNI but it's not going to be an easy setup I think: http://nginx.org/en/docs/mail/ngx_mail_ssl_module.html

1st update:
two links that might help you:
http://citrin.ru/nginx:ngx_mail_core_module
http://wiki.nginx.org/MailCoreModule

2nd update:
As of 2016 you can easily get SAN certificates from the Let's Encrypt Project for free.

I strongly suggest, you get yourself a SAN certificate and include all the FQDN you need for your service in that one certificate. Currently you can include as many as 100 subject alternative names per certificate.

8
  • nginx is a good idea but it's not for free, is it? Nov 28, 2014 at 16:02
  • 1
    nginx is free, see: nginx.org/LICENSE
    – r_3
    Nov 28, 2014 at 17:17
  • What exactly is the purpose of your endeavour? Do you need multiple FQDN's for your clients being able to connecting securely to different hostnames or for the smtpd delivering it?
    – r_3
    Dec 1, 2014 at 15:54
  • Yes! I have multiple domains and I want my clients not to hear certificate complaints when sending e-mails. Dec 2, 2014 at 19:19
  • Do your clients really need to use their domain when delivering mail to the MTA? To my knowledge there is no reason why not to buy one cheap certificate for a FQDN unrelated to any of your customers. For delivery the RFC's state that any certificate should be accepted because even the lack of STARTTLS should not cause your mail to bounce. So the only reason that remains is your customers really wanting to use their domain in the settings of their client. Something once set up, never shows up again.
    – r_3
    Dec 2, 2014 at 22:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.