I'm working on an Ubuntu server hosting multiple websites for one company. Trying to get one of the domains to be PCI compliant, but it's failing on port 25 (SMTP) because the SSL certificate hostname doesn't match.
Each domain hosted on the server has its own valid SSL certificate, or some share multi-domain certificates. The PCI scan validates the SSL certificate on port 443.
The mail server is Postfix, and the
main.cf config uses a valid wildcard SSL certificate that is used for the "main" domain of the company. The domain I'm trying to validate for PCI is another domain.
I don't really understand how this could be set up to use a SSL certificate on port 25 which will be valid for any domain hosted on this server that needs to pass PCI. This is slightly outside my areas of knowledge at the moment.
www.pci.domain - The domain I'm trying to make PCI compliant (not actual name obviously).
- Has its own valid certificate
- Incoming mail goes to Microsoft Outlook via DNS:
MX 10 pci.domain.mail.protection(not sure if this is relevant).
www.other.domain - The company's "main" domain.
- Has its own valid wildcard certificate
Postfix uses the certificate of other.domain at the moment, which is obviously not valid for pci.domain or any other domains when the PCI scan tries to verify that port 25 is secure for those other domains.