[BlueOnyx:25007] Re: TLS

[Colin Jack]

Hi Michael,

On 20/07/2021, 17:20, "Blueonyx on behalf of Michael Stauber" <blueonyx-bounces at mail.blueonyx.it on behalf of mstauber at blueonyx.it> wrote:

    Hi Colin,

    > Am I correct that with the new 5210R if I set up a vsite with SSL users
    > can collect email using the vsite url and tls?
    > 
    > e.g. vsite called mail.mydomain.com connect with starttls.

    That is correct. How it works is explained here:

    https://www.blueonyx.it/news/267/15/5210R-Postfix-SNI-for-email-and-Maildir/

    https://www.blueonyx.it/news/266/15/5209R5210R-SNI-support-added-to-Dovecot/

    In a nutshell it's like this:

    Switch the 5210R's MTA from Sendmail to Postfix via the GUI.

    Both Dovecot and Postfix use all SSL certificates that are installed on
    the server: The AdmServ cert (like they did before) plus the
    certificates from all Vsites that have an SSL certificate.

    If Vsite www.company.com has an SSL certificate, then the end-user can
    configure his email client to directly send/receive emails via
    www.company.com and both Postfix and Dovecot will present the SSL
    certificate for www.company.com instead of using the AdmServ
    certificate. Hence there will be no "certificate mismatch" warning.

    If someone does this for a Vsite that has no SSL certificate (yet), then
    the AdmServ certificate will be used instead, which is the traditional
    behavior that we had before.

    > I’m looking to migrate a complete old 5107R dedicated mail server onto
    > the new host as a vsite.
    > 
    > Currently users are using the server FQDN to connect and many use tls so
    > don’t want the hassle of asking them to make changes.

    That still works and users don't have to make any changes. But if their
    Vsite has an SSL certificate, they can optionally switch their SMTP and
    POP3/IMAP settings over to that instead and they won't see a
    "certificate mismatch" error.

    
Perfect! Thank you.

Kind regards

Colin