On Seg, 2009-11-30 at 16:34 +0100, Thomas Hummel wrote:

Hello Timo,

I'd like to check if my understanding of dovecot-1.2.x's SSL certificate handling is correct :

SSL does not provide the server any mechanism to choose which certificate
it must send relatively to the name the client is using. Thus, if you want to
use different certificates, you have to listen to different addresses. This is
an SSL limitation, not a dovecot nor IMAP limitation.

This is the reason why it's possible to use different certificates for IMAP
and POP3.  But it seems to work only with those two :

As a matter of fact, even if you listen to different addresses, how would
you tell dovecot to send this certificate for this address and that certificate
for that address, since there is no IP dependent section (as in apache IP-based
virtual host for instance) ? It seems the only way would be to have more than
one instance of dovecot (several dovecot with different config files).

The problem is that some clients may be configured with mail.my.domain, some others with imap.my.domain, ...etc... Hence the need to have different certificates with those different names as cn.

The client compares the CN of the certificate with the hostname it has configured and warns on a mismatch. What you can do is have multiple subjects certificate, that is a certificate again with a single CN but with multiple alt subjects that should cover all the names that server may have. The client should support those kind of certificates, of course.

-- Jose Celestino SAPO.pt::Systems http://www.sapo.pt --------------------------------------------------------------------- * Progress (n.): The process through which Usenet has evolved from smart people in front of dumb terminals to dumb people in front of smart terminals.