You want the short or long answer :-)
There are two aspects to be considered:
- surgemail deciding which certificate to serve
- the browser matching the certificate against the correct url hostname.
Traditionally you had either g_ssl_per_domain in which case you needed to have a certificate per domain, and to use an separate ip address per domain, or you left g_ssl_per_domain disabled and you had the whole server secured on a single hostname.
This would would with wildcard certificates (is that what you are referring to with UCC as I'm not familiar with that terms), but the price and domain restrictions on these tend to mean that people do not use them.
However, as of 6.0 surgemail support SNI, this should mean that surgemail no longer needs to use the ip address to identify the certificate to server. You would still use a certificate per domain, these being stored in the surgemail/ssl/
domain.com directories but you can serve all these on the same ip address.
I also believe there is some form of option of combining multiple certificates in one, but I have to admit I've never actually tried that myself so there may be hidden gotchas and possibly costs at the certificate issuing side.
Anyway, I suggest using maybe:
mail.yourprimarydomain.com as the hostname with your company certificate for all the domains that do not need their own certificate and
mail.company-a.com etc with its own certificate for other domains needing their own certificates this can all be on the same ip address now if wanted.
But maybe someone else on the list has further input too?
Marijn
On Wednesday 24/07/2013 at 11:38 pm, Chris Ferebee wrote:
I'm trying to understand how to set up SSL over multiple domains in SurgeMail, so that different users can login via IMAP etc. as "user-1@company-a.com" and "user-2@company-b.com" to the server using the hostnames "mail.company-a.com" and "mail.company-b.com" over SSL.
Initially, I thought I could obtain a UCC certificate (from StartSSL.com) listing all the SSL domains as Subject Alternate Names, however it turns out that UCCs are not allowed to cover domains belonging to multiple separate organizations.
Therefore, I presume I would need to use multiple certificates and configure SurgeMail to answer with different certificates on multiple separate IP addresses.
I also host a number of domains that don't each need their own SSL hostname.
How does this relate to g_ssl_per_domain? If I enable that, can I use several IP addresses but still host multiple virtual domains on each IP? I'm thinking of a setup like this:
IP 1.1.1.1 - canonical name "mail.company-a.com" - SSL certificate for "mail.company-a.com" with SAN "company-a.com"
IP 1.1.1.2 - canonical name "mail.company-b.com" - SSL certificate for "mail.company-b.com" with SAN "company-b.com"
Additional vdomains on each IP - but I presume the server would need to handshake with the canonical name on each IP so as not to break SSL.
Will that work, and how do I set it up?
Best,
Chris Ferebee
