SSL Certificate for Mail Server

[IsmaeelA]

Hi guys,

I'm a newbie in the SSL field.

I’ve read the documentations of (PBAS, Plesk, and Securing Websites).
I need to know, how to add SSL Certificate to our Webmail?

In addition, I need to know, how to request CSR key and install SSL for our mail server in order for us to protect our emails and to use the SSL Protocol in mail softwares such as Outlook?

I will explain the scenario in details:
1- We have (www.example.com) which is our "Plesk Server hostname" and a subscription in our "Plesk Server".
2- We have (pbas.example.com) which is our "PBAS Server hostname" and it's not a subscription in our "Plesk Server".
3- We have (account.example.com) which is a "Subscription" in our "Plesk Server".

Here are the DNS records of our domain and subdomains:
Host-Type-Data
-A-192.168.1.30
www-A-192.168.1.30
mail-A-192.168.1.30
pbas-A-192.168.1.31
account-A-192.168.1.32
-MX-example.com.

So, can you guys please tell/guide me how to generate CSR key for each domain/subdomain and how to install the SSL for it?

Note:
Our "Plesk" is 11.5 and installed on CentOS 6.4.

I'll appreciate it.

Thanks.

 

[IsmaeelA]

I really need a help with the SSL Certificate.
I hope that there is someone who could help me with it.

Thanks.

 

[IsmaeelA]

Please help me to know what should I do?


Thanks.

 

[IgorG]

Have you tried to use forum's search engine and read this thread, for example - http://talk.plesk.com/threads/roundcube-webmail-ssl.310916/ ?

 

[IsmaeelA]

Hi IgorG,

Thanks for the URL it was really helpful.
What about "how to request CSR key and install SSL for our mail server in order for us to protect our emails and to use the SSL Protocol in mail softwares such as Outlook?".

Let me say, if I installed the SSL Certificate for the main domain (www.example.com) and I used (mail.example.com) as the SMTP/POP3 server in MicroSoft Outlook, will the emails be secured?

Thanks.

 

[Faris Raouf]

Hi IgorG,

Thanks for the URL it was really helpful.
What about "how to request CSR key and install SSL for our mail server in order for us to protect our emails and to use the SSL Protocol in mail softwares such as Outlook?".

Let me say, if I installed the SSL Certificate for the main domain (www.example.com) and I used (mail.example.com) as the SMTP/POP3 server in MicroSoft Outlook, will the emails be secured?

Thanks.

Not really, no.

There are two issues to deal with.

First of all, a normal SSL certificate ONLY works with the domain (the WHOLE domain) you use when you request it. So, for example, an SSL certificate for www.domain.tld will not work with mail.domain.tld

In order to cover *.domain.tld you need what's called a wildcard certificate, which covers anything.domain.tld (and also domain.tld). These are a little more expensive - 3 to five times more expensive - than a standard SSL certificate.

So it may be that it will be cheaper to purchase a wildcard certificate than an individual SSL certificate for each domain you want to cover.

Now, going back to mail and outlook and SSL, keep in mind that to protect your connections you do not need to purchase a certificate. You can use a self-signed one. HOWEVER, most email programs will display an error message when you use a self-signed certificate. This is why most people prefer to use a "real" one.

In your case you could purchase an SSL certificate for mail.domain.tld and use that in the PEM file outlined in the KB, or you could use a wildcard for domain.dlt instead.

Keep in mind, however, that if your customers connect to mail.their-domain.tld they will see errors generated by their email client because the SSL is for domain.tld not their-domain.tld.

 

[IsmaeelA]

Hi Faris,
Thank you very much.
I really appreciate it.

As I wrote in the first post, the mail.domain.tld is not hosted at all, it's just a record in our DNS Name Server.

So, how will we generate the CSR for mail.domain.tld?


Thanks.

 

[UFHH01]

Hello IsmaeelA,

please don't mix a "webserver" - certificate ( secures HTTPS connections - Ports 443 / 7081 / 8443 ) with "eMail - server" - certificates ( secures conections over IMAPS - Port 993 / POP3S - Port 993 / SMTPS - Port 465 ) , FTP - server certificates ( secures FTPS - connections - Port 990 ) or S/MIME - certificates ( to encode/encrypt eMails ).

In addition, I need to know, how to request CSR key and install SSL for our mail server in order for us to protect our emails and to use the SSL Protocol in mail softwares such as Outlook?

To secure your connections to and from the eMail - server, you might have a look at:

How can I change the default certificates for SMTP, IMAP, and POP3 over SSL? ( KB - article 1062 )
​

To generate and use a S/MIME - certificate for your eMails, please have a look at:

http://www.bestinternetsecurity.net...or-smime-secure-mime-email-communication.html

or please use Google to search for other tutorials ( search - words suggested: "S/MIME" "YOUR_EMAIL_CLIENT "certificate" "generate" )​

 

[IsmaeelA]

Hi UFHH01
Thanks for clarifying that.
I didn't know there is a difference between the Webserver SSL and the eMail server SSL, as I mentioned before, I'm a newbie in the SSL.

Thanks again

 

[Hotte]

@UFHH01 Is it possible to setup S/MIME on Plesk? (for eMail encryption)

 

[MarkM]

Sure, but Let's Encrypt doesn't support it - so you'll need a different cert.