SSL SNI

Idea shared by Sérgio Rocha - 10/21/2016 at 3:44 PM

Completed

HI Everyone,

I Know that now its not a best time to ask this kind of changes, ST is preparing the lunch of version 16, but i would like to see in roadmap.

This week i was working with Exim from cpanel and saw that they can do SNI in email services (POP/IMAP/SMTP), witch is very good to host different SSL/hosts communications in the same IP.

I like to propose to everyone to push this idea so we can have more clients using SSL with the need to bind a dedicates IP. (Witch dont work very well because the autodiscovery configuration).

We need this kind of enterprise solution for bigger clients and to promote the SSL use. We have lots of stolen password because users dont use SSL, and the bigger clients want a vanity configuration.

Regards,

20 Replies

Reply to Thread

Lakshan Salgado Replied

10/23/2016 at 4:18 AM

I would agree as well along with https redirects for ALL web mail. We've asked for this for along time. I'd rather see this implemented than year over year 'new' versions being released.

Employee Replied

10/24/2016 at 12:40 PM

Employee Post

Sergio,

I'll be glad to submit this as a feature request, I agree this would be a huge improvement to our existing SSL\TLS implementation.

Sérgio Rocha Replied

10/24/2016 at 2:01 PM

Thanks Von-Austin See Shouldn't be simple but will be very nice to have and I'm very happy that ST consider the request.

kevind Replied

10/24/2016 at 2:58 PM

What about using Let's Encrypt (https://letsencrypt.org/)? Seems like everyone is starting to use that now.

Employee Replied

10/24/2016 at 3:12 PM

Employee Post

Kevin, these certificates should be supported. We don't have anything built directly into SmarterMail to handle the certificates and the enrollment for you, but you can leverage one of their many Windows clients to handle this for you.

You would just need to pay attention to when the certificates expire, and export new PFX files containing the private key, and password protected and point SmarterMails ports to these to avoid any cert errors.

ACMESharp seems to be pretty straight forward and uses PowerShell modules so this can be performed remotely as well. Here's their quickstart guide that walks you through their process, and also details how to export as PFX in the end of the article.

https://github.com/ebekker/ACMESharp/wiki/Quick-Start

I hope this helps.

kevind Replied

10/25/2016 at 8:13 AM

Von, thanks for the instructions! I guess my request would be that ST bake some of this functionality into SM like you do with SpamAssassin, etc. This would relieve the admin from the technical details and renewing the certificate every 90 days.

Employee Replied

10/25/2016 at 8:26 AM

Employee Post

I agree Kevin, this would be very slick to have within SmarterMail to handle certificate enrollment as well as automatic renewals. I've submitted this as a feature request.

kevind Replied

10/25/2016 at 8:40 AM

Nice! Thank you.

FlexWS Replied

11/1/2016 at 9:24 AM

Please note (for a small amount of people using Android pre 4.2) that SNI is not understood on those devices.

Lakshan Salgado Replied

1/26/2017 at 8:22 AM

Agreed here as well. We sell several products today that not only allow for a automatic SSL request from lets encrypt but also automatically renew the cert at the 4 month mark so no admin burden is added. Considering where security is today this I would state is an expected feature from Enterprise level software such as SM.

Lakshan Salgado Replied

1/26/2017 at 8:23 AM

Hey Smartermail, where is your dev team on this ? We need to stop burning IPV4 addresses....

Todd Graf Replied

4/12/2017 at 7:53 AM

We've switch 90% of our certs over to Let's Encrypt. Smartermail and our spam filter aren't ready yet. The https cert in IIS is easy to do. The SMTP, IMAP, and POP SSL ports don't seem to pick up the renewal automatically.

Employee Replied

4/12/2017 at 8:16 AM

Employee Post

Todd, you'll need to automate exporting of the renewed LetsEncrypt SSL certificate to a PFX file that's password protected and contains the private key. You'll need to do this since SmarterMail does not tap into the certificate store directly but instead references direct PFX and .CER files assigned to your ports.

As long as your exporting to the same certificate location that's tied to your SmarterMail port bindings, you should be good to go until SmarterTools implements support for the Let's Encrypt platform.

I recommend PowerShell to perform these actions since it does contain an Export-pfxCertificate cmdlet. More information on this command can be found here: https://technet.microsoft.com/en-us/itpro/powershell/windows/pkiclient/export-pfxcertificate

Lakshan Salgado Replied

5/4/2017 at 7:06 AM

Hey Smartermail dev team - Is SNI supported now that https URL redirection is possible on SM16? (hint: we've had SNI support on the Microsoft platform for a several years now...)

jorge.mx.neto Replied

7/6/2017 at 9:03 AM

Let's keep the ball rolling, with the bellow PS, I can export the .pfx file with password to some folder where SM can grab it:

$CertPassword = '123456789'
$CertDNSName = '<domain name>'

$SecurePassword = ConvertTo-SecureString -String $CertPassword `
                                         -AsPlainText `
                                         -Force

$CertFileFullPath = $(Join-Path (Split-Path -Parent 'D:\_Server\Cert\') "$CertDNSName.pfx")

$NewCert = New-SelfSignedCertificate -CertStoreLocation Cert:\CurrentUser\My `
                                     -DnsName $CertDNSName

Export-PfxCertificate -FilePath $CertFileFullPath `
                      -Password $SecurePassword `
                      -Cert $NewCert

Shawn Hyde Replied

8/7/2017 at 3:42 PM

I have this working for me... I do not know if my scheduled task will handle an update after the first one expires, but time will tell. I can always run it manually every few months.

Note:
SmarterMail picks up new certificates very quickly when the old one is overwritten.

Note:
$ExistingCerts[0] is an expression that selects the first found match. If you have more than one match you may accidentally have the wrong certificate, or it may put the newer one at the top (that would be awesome).

Note: Get-ChildItem is what gets a list of certificaes that match the criteria, in this case : date of expiration is greater than 0 but less than 101 and has a dns name of your specified DNS Name and lastly is stored in your local machine personal certificate list

$CertPassword = 'the-best-password-ever'
$CertDNSName = 'mail.the-best-domain-name-ever.com'

$SecurePassword = ConvertTo-SecureString -String $CertPassword `
-AsPlainText `
-Force

$CertFileFullPath = "C:\SmarterMail\Certificates\$CertDNSName.pfx"

$ExistingCerts = Get-ChildItem -DnsName $CertDNSName -ExpiringInDays 100 -Path Cert:\localMachine\my\

Export-PfxCertificate -FilePath $CertFileFullPath `
-Password $SecurePassword `
-Cert $ExistingCerts[0]

Matthew Leyda Replied

1/11/2018 at 11:43 AM

bump

Kendra Support http://www.kendra.com support@kendra.com 425-397-7911 Junk Email filtered ISP

John Marx Replied

1/11/2018 at 3:30 PM

Not sure about a BUMP (but agree). Just read the following article from Smarter Toolls

https://www.smartertools.com/blog/2017/08/14-secure-smartermail-with-lets-encrypt

What I want to know is can we get Let's Encrypt when a domain is created that we create a Let's Encrypt so that every clients login is secured? This should be 100% seamless option. Can this be done?

Justin Clester Replied

1/11/2018 at 4:05 PM

John, we have tossed around the idea of implementing Let'sEncrypt directly into SmarterMail for seamless certificate requests and renewals. It's definitely on our radar but hasn't been scheduled for development at this time.