1

Users on several domains connect the the mailserver cluster. The cluster consists of 3 servers.

  • SRV1.hostdomain.com
  • SRV2.hostdomain.com
  • SRV3.hostdomain.com

These servers are combined with MX records behind securemail.hostdomain.com with their respective priority.

Clients see the email server as mail.theirdomain.com, which is cnamed to securemail.hostdomain.com.

I will setup hostdomain.com with a wildcard SSL certificate.

The problem that this serves is that a client can not use SSL over their mail.theirdomain.com.

Should i be using a multidomain SSL certificate or and what kind of ssl certificate should i use?

1
  • what type of access do you provide the client? in any case, if you want to act as a provider you should act like a provider and use the same domain for all customers, (see google apps, o365, etc) – Jacob Evans Jun 23 '17 at 16:39
1

Some mail server support multiple certificates on the same IP address but they need a SNI aware client for this so that the proper certificate can be provided. Not all clients support SNI so you can not rely on this.

This means that you have to live with a single certificate on your mail server. The easiest way would just setup the MX for the client domains to point to this server securemail.hostdomain.com and not to mail.theirdomain.com as you currently do.

If you don't want to go this simple way you need a multi-domain certificate which includes all domains you want to serve on this server. Of course it is necessary for this the you actually own all these domains or at least have enough access to be able to react to the challenge used in DV certificate validation. If these domains are instead in full control of the client you cannot do this.

0

As far as I know only one certifcate can be installed on mail server so yes, you can have multidomain certficate or tell your client to ignore the SSL warning.

0

If you want the client to use their own domain, you need to use a certificate with with multiple SAN (Subject Alternative Names), one for each domain you want to answer as.

see Thawtes info on this

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.