Resolved SNI Enabled but Aliased Domain not in Mail Cert?

[G J Piper]

I have a domain (askb.org) set up for mail with Let's Encrypt enabled and it issues certificates for the website.
I added www.mail.askb.org as an alias to the domain so my clients' existing email server setups would not have to be changed to the root domain (they all use mail.askb.org).
I can secure the webmail and website and mail using the cert, but the mail cert shows that the alias isn't included in it even though the website cert shows it as an alt?
Going directly to the domain's mail settings allows me to only add the main domain's cert (which presumably should have the added mail. cert in it as an alt domain like the rest)
Confused...
Mail clients don't show the "mail.askb.org" domain so they fail verification unless the settings are changed in the clients' mail settings.

Running:

openssl s_client -connect mail.askb.org:465

reveals that the server still only uses the main mail certificate for all domains?

If I change the main mail server certificate to be the askb.org lets encrypt cert then it works, but it looks like individual domains on the server do not override that setting with their own Let's Encrypt cert.

 

[G J Piper]

Upon further testing this seems to be working now. Not sure why remote queries show the main server cert instead of the sni ones, but actual mail clients seem to see the correct ones.

 

[MARS_NETWORKS]

Hello GJ Piper

I don't see the same parameters than you in the email domain preferences...
How did you get this ?
I only have SSL/TLS certificate for webmail

Pretty upseted by Plesk on this point for many years now...
I was told that Obsidian will solve this problem and nothing changed


[EDIT]: my mistake !
Everything is OK.
Just have to migrate all customers emails to Obsidian now...

 

[seqoi]

Pretty upseted by Plesk on this point for many years now...
I was told that Obsidian will solve this problem and nothing changed

But they changed it in Obsidian?! That fact you are seeing his screenshot doesn't convince you?

If you don't see same options like GJ Piper then some option may be disabled at your installation. Especially if you run upgrade from Onyx instead of clean install. Check their documents. I can't find link anymore but i saw some settings need to be enabled manually if you are upgrading from Onyx. Better yet ask their support directly.

 

[Nik G]

As I know only postfix and dovecot support SNI. So SNI will not be available for you in case if you're using courier-imap or qmail.

 

[seqoi]

As I know only postfix and dovecot support SNI. So SNI will not be available for you in case if you're using courier-imap or qmail.

From their FAQ

MailEnable 10.20 and Postfix 3.4 support SNI for mail.

FAQ for Plesk