[Dovecot] SSL Compatibility? SNI vs SAN (Subject Alternative Names) and multiple domains
Getting ready to redo our mail server setup and I'm trying to wrap my head around the ins and outs and pratfalls involved in SSL, multiple domains, and Dovecot. I've taken a look at:
http://wiki2.dovecot.org/SSL/DovecotConfiguration
My basic understanding at this point is that:
With SSL for IMAP/POP3, it is limited to one certificate per IP address, because the SSL process starts as soon as the client opens the socket to the IP address. In order to support multiple domains / server names, you have to rely on SAN (Subject Alternative Names) in the server's SSL certificate.
If I use STARTTLS for IMAP/POP3 and Dovecot 2.x, then the SNI process will allow the client to specify that they want to talk to mail server XYZ and Dovecot will hand the correct certificate to the client. However, a lot of devices don't support SNI yet so this is fraught with peril and incompatibilities.
So it seems like if I have fewer IP addresses then mail server names, I should stick with a single SSL cert and use SANs. (Wildcard certs are not an option due to the top level domain being different.)
How big of an issue is a cert with half a dozen or a dozen SANs attached? Do most mail clients handle that sort of certificate properly in order to access their mailboxes?
Reference links:
http://www.digicert.com/subject-alternative-name-compatibility.htm
Hi
How big of an issue is a cert with half a dozen or a dozen SANs attached? Do most mail clients handle that sort of certificate properly in order to access their mailboxes?
I think it's been discussed here before, but roughly speaking yes it works fine. I use it on my mailservers and don't obviously see problems with common clients.
I think in the archives you might find that there are a few less common clients which aren't happy, but I think all modern MS clients, and the other big alternatives are fine?
I bought from godaddy because it was quite cheap to get such a cert...
Good luck
Ed W
On Mar 16, 2011, at 6:21 PM, Ed W lists@wildgooses.com wrote:
Hi
How big of an issue is a cert with half a dozen or a dozen SANs attached? Do most mail clients handle that sort of certificate properly in order to access their mailboxes?
I think it's been discussed here before, but roughly speaking yes it works fine. I use it on my mailservers and don't obviously see problems with common clients.
I think in the archives you might find that there are a few less common clients which aren't happy, but I think all modern MS clients, and the other big alternatives are fine?
I bought from godaddy because it was quite cheap to get such a cert...
Good luck
Ed W
So you're not having acceptance issues with godaddy certs? I moved away from them because there was virtually no recognition for mail clients at the time. Although I do believe they changed root certs since then...
Rick
if you want cheap, startssl.com. $0 certs available and they work fine w/ dovecot.
-david
Do they work without any error messages with all the major MUAs? For sending (SMTP) and receiving? (POP/IMAP) etc.
Thanks
On 17/03/11 1:34 PM, "David Ford" david@blue-labs.org wrote:
if you want cheap, startssl.com. $0 certs available and they work fine w/ dovecot.
-david
On 17/03/2011 00:03, Rick Romero wrote:
So you're not having acceptance issues with godaddy certs? I moved away from them because there was virtually no recognition for mail clients at the time. Although I do believe they changed root certs since then...
Been using them for 2 years without anyone obviously noticing?
I will have to double check now, but I thought they were chain signed by a big upstream name? You do need to add the intermediate cert, and if you forget that then probably nothing will accept your cert?
I am definitely not the largest shop in the world though... I suspect the only customers using SSL will be those using clients which default to it being on, ie OSX, newer thunderbird and I think newer Outlook?
Cheers
Ed W
On 3/16/2011 7:21 PM, Ed W wrote:
How big of an issue is a cert with half a dozen or a dozen SANs attached? Do most mail clients handle that sort of certificate properly in order to access their mailboxes?
I think it's been discussed here before, but roughly speaking yes it works fine. I use it on my mailservers and don't obviously see problems with common clients.
I had looked through my mail archives back through 2008, found a threads on the topic.
For posterity's sake (and if anyone wants to dig those up)... One from Jan 2010 titled "Dovecot version 2 and multiple SSL certificates" which is covered in the Wiki (using SNI). Prior to that was a topic from Dec 2009 titled "virtual domains and SSL certificates" (which boiled down to "wait for Dovecot 2.x"). And one from Nov 2009 titled "Dovecot SSL limitations" (which talks about SAN certificates).
I'm just leery of using SNI because it's from circa 2006, so is rather new. So for the next few years it sounds like a SAN cert is still the way to go even with the downsides.
I guess the big issue with SAN certs is that I'll need to make sure to identify every DNS name that could possible be attached to that server's IP and/or services that I'll want to use SSL for (not just Dovecot for POP3/IMAP, but also Postfix, PostgreSQL and Apache).
I think in the archives you might find that there are a few less common clients which aren't happy, but I think all modern MS clients, and the other big alternatives are fine?
I suspect so, all of my expected users are either using Thunderbird 3.x or fairly modern versions of MS Outlook (2003+). The rest can just use the webmail client.
I bought from godaddy because it was quite cheap to get such a cert...
Leaning towards DigiCert at the moment, personally not a GoDaddy fan (and that's a whole different topic). Verisign and Thawte were rather pricey compared to DigiCert. Not terribly interested in the free certs because this SSL cert would also be used for non-company users and we don't want browser warnings to pop up.
Good luck
Ed W
Thanks. I thought I understood this a few years ago when I did my first Dovecot + SSL install, but apparently I did not grasp some of the subtleties with regards to SSL vs STARTTLS.
On 03/16/2011 10:10 PM, Thomas Harold wrote:
Leaning towards DigiCert at the moment, personally not a GoDaddy fan (and that's a whole different topic). Verisign and Thawte were rather pricey compared to DigiCert. Not terribly interested in the free certs because this SSL cert would also be used for non-company users and we don't want browser warnings to pop up.
I've become a fan of StartSSL (from StartCom.org) and their free class 1 certificates. StartCom's root CA is included in Microsoft's, Mozilla's, Apple's, and even Android's list of trusted root certificates.
participants (7)
-
Charles Marcus
-
Craig Whitmore
-
David Ford
-
Ed W
-
Rick Romero
-
Thomas Harold
-
Willie Gillespie