<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi Taco,</p>
<p>Welcome back, it's good to "see" you again.<br>
</p>
<br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<blockquote type="cite"
cite="mid:C192BE21-C4EF-428C-BB91-F26990411D74@blueonyx.nl">
<div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">In
the past I had all my customers connect to mail. followed by
their own domain name and when secure smtp and pop3/imap was
not active that worked fine.</span><br style="caret-color:
rgb(0, 0, 0); color: rgb(0, 0, 0);">
<span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">But
since secure smtp (SSL or STARTTLS) or secure pop3/imap is the
standard, the customers get confronted with a certificate
warning as the server will respond with the server’s hostname
in the certificate.</span><br style="caret-color: rgb(0, 0,
0); color: rgb(0, 0, 0);">
<br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">I
have been thinking about including all the mail.* hostnames in
the ’server’ certificate, but LE certificates can only hold up
to 100 hostnames, so on servers with more than 100
domains/vhosts, this approach does not work well.</span><br
style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">So
I am wondering how others do this.</span></div>
</blockquote>
<p>Right. On our fleet of legacy (5209R) BlueOnyx servers, we have
instructed customers to use the server hostname to make a
connection. In other words, if they are hosted on, for instance,
web1.domain.tld, we simply place in their instructions to use
web1.domain.tld in the incoming/outgoing hostname.</p>
<p>This isn't 100% perfect, since if we migrate the domain to
another server (ie: web2.domain.tld) then the certificate will
fail again. However, we don't typically do this, and if we do
migrate VSITEs to another server, it's usually to a direct
replacement so the hostname will stay the same. (This would
occur if we upgraded from 5209R to 5210R.)</p>
<p>Beginning with 5210R, it's possible to use SNI:
<a class="moz-txt-link-freetext" href="https://www.blueonyx.it/news/267/15/5210R-Postfix-SNI-for-Email-and-Maildir">https://www.blueonyx.it/news/267/15/5210R-Postfix-SNI-for-Email-and-Maildir</a></p>
<p>You mention LE not having the ability to use > 100 hostnames,
and my suggestion might be to cap the number of VSITEs hosted on a
particular server. Since nearly everything we do is virtualized
these days, that's a good way for us to not have too many eggs in
a single basket.</p>
<p>These approaches may not be a one-size-fits-all, but it gives
some insight on what we're doing.<br>
</p>
<pre class="moz-signature" cols="72">--
Chris Gebhardt
VIRTBIZ Internet Services
Access, Web Hosting, Colocation, Dedicated
<a class="moz-txt-link-abbreviated" href="http://www.virtbiz.com">www.virtbiz.com</a> | toll-free (866) 4 VIRTBIZ</pre>
</body>
</html>