• We value your experience with Plesk during 2024
    Plesk strives to perform even better in 2025. To help us improve further, please answer a few questions about your experience with Plesk Obsidian 2024.
    Please take this short survey:

    https://pt-research.typeform.com/to/AmZvSXkx
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

SSL Certificate for Mail Server

IsmaeelA

Basic Pleskian
Hi guys,

I'm a newbie in the SSL field.

I’ve read the documentations of (PBAS, Plesk, and Securing Websites).
I need to know, how to add SSL Certificate to our Webmail?

In addition, I need to know, how to request CSR key and install SSL for our mail server in order for us to protect our emails and to use the SSL Protocol in mail softwares such as Outlook?

I will explain the scenario in details:
1- We have (www.example.com) which is our "Plesk Server hostname" and a subscription in our "Plesk Server".
2- We have (pbas.example.com) which is our "PBAS Server hostname" and it's not a subscription in our "Plesk Server".
3- We have (account.example.com) which is a "Subscription" in our "Plesk Server".

Here are the DNS records of our domain and subdomains:
Host-Type-Data
-A-192.168.1.30
www-A-192.168.1.30
mail-A-192.168.1.30
pbas-A-192.168.1.31
account-A-192.168.1.32
-MX-example.com.

So, can you guys please tell/guide me how to generate CSR key for each domain/subdomain and how to install the SSL for it?

Note:
Our "Plesk" is 11.5 and installed on CentOS 6.4.

I'll appreciate it.

Thanks.
 
I really need a help with the SSL Certificate.
I hope that there is someone who could help me with it.

Thanks.
 
Hi IgorG,

Thanks for the URL :) it was really helpful.
What about "how to request CSR key and install SSL for our mail server in order for us to protect our emails and to use the SSL Protocol in mail softwares such as Outlook?".

Let me say, if I installed the SSL Certificate for the main domain (www.example.com) and I used (mail.example.com) as the SMTP/POP3 server in MicroSoft Outlook, will the emails be secured?

Thanks.
 
Hi IgorG,

Thanks for the URL :) it was really helpful.
What about "how to request CSR key and install SSL for our mail server in order for us to protect our emails and to use the SSL Protocol in mail softwares such as Outlook?".

Let me say, if I installed the SSL Certificate for the main domain (www.example.com) and I used (mail.example.com) as the SMTP/POP3 server in MicroSoft Outlook, will the emails be secured?

Thanks.

Not really, no.

There are two issues to deal with.

First of all, a normal SSL certificate ONLY works with the domain (the WHOLE domain) you use when you request it. So, for example, an SSL certificate for www.domain.tld will not work with mail.domain.tld

In order to cover *.domain.tld you need what's called a wildcard certificate, which covers anything.domain.tld (and also domain.tld). These are a little more expensive - 3 to five times more expensive - than a standard SSL certificate.

So it may be that it will be cheaper to purchase a wildcard certificate than an individual SSL certificate for each domain you want to cover.

Now, going back to mail and outlook and SSL, keep in mind that to protect your connections you do not need to purchase a certificate. You can use a self-signed one. HOWEVER, most email programs will display an error message when you use a self-signed certificate. This is why most people prefer to use a "real" one.

In your case you could purchase an SSL certificate for mail.domain.tld and use that in the PEM file outlined in the KB, or you could use a wildcard for domain.dlt instead.

Keep in mind, however, that if your customers connect to mail.their-domain.tld they will see errors generated by their email client because the SSL is for domain.tld not their-domain.tld.
 
Hi Faris,
Thank you very much.
I really appreciate it.

As I wrote in the first post, the mail.domain.tld is not hosted at all, it's just a record in our DNS Name Server.

So, how will we generate the CSR for mail.domain.tld?


Thanks.
 
Hello IsmaeelA,

please don't mix a "webserver" - certificate ( secures HTTPS connections - Ports 443 / 7081 / 8443 ) with "eMail - server" - certificates ( secures conections over IMAPS - Port 993 / POP3S - Port 993 / SMTPS - Port 465 ) , FTP - server certificates ( secures FTPS - connections - Port 990 ) or S/MIME - certificates ( to encode/encrypt eMails ).


IsmaeelA said:
In addition, I need to know, how to request CSR key and install SSL for our mail server in order for us to protect our emails and to use the SSL Protocol in mail softwares such as Outlook?

To secure your connections to and from the eMail - server, you might have a look at:


To generate and use a S/MIME - certificate for your eMails, please have a look at:

http://www.bestinternetsecurity.net...or-smime-secure-mime-email-communication.html

or please use Google to search for other tutorials ( search - words suggested: "S/MIME" "YOUR_EMAIL_CLIENT "certificate" "generate" )
 
Hi UFHH01
Thanks for clarifying that.
I didn't know there is a difference between the Webserver SSL and the eMail server SSL, as I mentioned before, I'm a newbie in the SSL.

Thanks again :)
 
Sure, but Let's Encrypt doesn't support it - so you'll need a different cert.
 
Back
Top