Thanks, Paul, for the details you sent off-list, which gave me something more to go on.
I've also discovered that if you turn on g_ssl_per_domain, SurgeMail will create subdirectories surgemail/ssl/domain.com, initially with self-signed certificates.
Perhaps this would work:
domains A, B, C on IP-1 (using Virtual Domain IP setting)
domains D, E, F on IP-2 (using Virtual Domain IP setting)
certificate with SANs A, B, C placed in each of the directories surgemail/ssl/A, /B, /C
certificate with SANs D, E, F placed in each of the directories surgemail/ssl/D, /E, /F
Marijn?
I'll have to experiment.
Chris
> On Jul 25, 2013, at 4:59 AM, Chris Ferebee HIDDEN@ebee.net> wrote:
>
>> Paul,
>>
>> If you could detail your configuration, that would be great. Specifically, I don't think I understand how to configure multiple IP addresses with a different certificate for each IP (spanning multiple domains with each certificate using SANs) and multiple virtual domains per IP.
>>
>> Thanks,
>> Chris
>>
>> Am 25.07.2013 um 04:02 schrieb "Paul M. Beck" HIDDEN@bexx.com>:
>>
>>> I have a server running 4 unique domains with unique ip's, all with ssl. 2 domains have multiple sites stacked on them.
>>>
>>> I have successfully used a wild card domain for shortcut implementations like clientdomain.mydomain.net
>>>
>>> I can give you config information if you wish
>>>
>>> Paul
>>>
>>> On Jul 24, 2013, at 8:00 PM, Surgemail Support (Marijn) <surgemailHIDDEN@t@netwinsite.com> wrote:
>>>
>>>> OK it does sound like the multiple domains per certificate would be ideal to use say one certificate for:
>>>> domain.com, mail.domain.com and even maybe imap.domain.com
>>>> but at the same time I've not had that running myself and sound like others have had issues. Having said that I'm sure I have had positive reports of users having it working fine under surgemail.
>>>>
>>>> As to SNI, no I'm not aware of mail client coverage - as you say - it is bound not to cover many older clients. Google does not seem to be giving me any definite answers on the matter either.
>>>>
>>>> Marijn
>>>>
>>>>
>>>>
>>>> On Thursday 25/07/2013 at 12:12 pm, Chris Ferebee wrote:
>>>>> Hmm, very interesting. It seems the implementation has outstripped the documentation. :-)
>>>>>
>>>>> FYI, "UCC" means "Unified Communication Certificate" and is just another name for a multi-domain certificate, i. e. a certificate that lists multiple domains as SANs (Subject Alternate Names). Many certificate authorities sell UCCs. StartCom ("StartSSL.com") is interesting because once you have validated your identity for a one-time fee, you can then generate any number of certificates, including UCCs, during a 1-year period, at no extra charge. However, all domains on one UCC must be validated to the same entity, as StartCom firmly informed me when I attempted otherwise. Other CAs have similar restrictions.
>>>>>
>>>>> I hadn't thought of SNI at all, that's an interesting approach.
>>>>>
>>>>> Do you have any idea which MUAs support SNI? I wonder whether support for older client systems would be an issue.
>>>>>
>>>>> Thanks,
>>>>> Chris
>>>>>
>>>>> Am 25.07.2013 um 00:51 schrieb Surgemail Support (Marijn) <surgemailHIDDEN@t@netwinsite.com>:
>>>>>
>>>>> You want the short or long answer :-)
>>>>>
>>>>> There are two aspects to be considered:
>>>>> - surgemail deciding which certificate to serve
>>>>> - the browser matching the certificate against the correct url hostname.
>>>>>
>>>>> Traditionally you had either g_ssl_per_domain in which case you needed to have a certificate per domain, and to use an separate ip address per domain, or you left g_ssl_per_domain disabled and you had the whole server secured on a single hostname.
>>>>>
>>>>> This would would with wildcard certificates (is that what you are referring to with UCC as I'm not familiar with that terms), but the price and domain restrictions on these tend to mean that people do not use them.
>>>>>
>>>>> However, as of 6.0 surgemail support SNI, this should mean that surgemail no longer needs to use the ip address to identify the certificate to server. You would still use a certificate per domain, these being stored in the surgemail/ssl/domain.com directories but you can serve all these on the same ip address.
>>>>>
>>>>> I also believe there is some form of option of combining multiple certificates in one, but I have to admit I've never actually tried that myself so there may be hidden gotchas and possibly costs at the certificate issuing side.
>>>>>
>>>>> Anyway, I suggest using maybe:
>>>>> mail.yourprimarydomain.com as the hostname with your company certificate for all the domains that do not need their own certificate and
>>>>> mail.company-a.com etc with its own certificate for other domains needing their own certificates
>>>>> this can all be on the same ip address now if wanted.
>>>>>
>>>>> But maybe someone else on the list has further input too?
>>>>>
>>>>> Marijn
>>>>>
>>>>> On Wednesday 24/07/2013 at 11:38 pm, Chris Ferebee wrote:
>>>>>
>>>>> I'm trying to understand how to set up SSL over multiple domains in SurgeMail, so that different users can login via IMAP etc. as "userHIDDEN@any-a.com" and "user-2@company-b.com" to the server using the hostnames "mail.company-a.com" and "mail.company-b.com" over SSL.
>>>>>
>>>>> Initially, I thought I could obtain a UCC certificate (from StartSSL.com) listing all the SSL domains as Subject Alternate Names, however it turns out that UCCs are not allowed to cover domains belonging to multiple separate organizations.
>>>>>
>>>>> Therefore, I presume I would need to use multiple certificates and configure SurgeMail to answer with different certificates on multiple separate IP addresses.
>>>>>
>>>>> I also host a number of domains that don't each need their own SSL hostname.
>>>>>
>>>>> How does this relate to g_ssl_per_domain? If I enable that, can I use several IP addresses but still host multiple virtual domains on each IP? I'm thinking of a setup like this:
>>>>>
>>>>> IP 1.1.1.1 - canonical name "mail.company-a.com" - SSL certificate for "mail.company-a.com" with SAN "company-a.com"
>>>>>
>>>>> IP 1.1.1.2 - canonical name "mail.company-b.com" - SSL certificate for "mail.company-b.com" with SAN "company-b.com"
>>>>>
>>>>> Additional vdomains on each IP - but I presume the server would need to handshake with the canonical name on each IP so as not to break SSL.
>>>>>
>>>>> Will that work, and how do I set it up?
>>>>>
>>>>> Best,
>>>>> Chris Ferebee
>>>>>
>>>>
>>>>
>>>
>>
>>
>
|
