questions about secure email

[Ovidiu]

I run a web and mail server for a few domains. running with ispcfg3 and according to the perfect debian server howto.
some of the users of a particular domain are using outlook and no matter what I do they are asked about accepting my self-signed certificate. I tried many solutions to import it into their computers but all fail. they are still being asked about accepting the certificate every time they open outlook again.

I have now decided to get a proper certificate but am not sure where to start.

1. any affordable certificate providers you can recommend?
2. will I need only 1 certificate for the server or does every domain need their own?
3. if I need only one, will there be problems since every customer accesses their mail via i.e. mail.domain1.com others via mail.anotherdomain.com, etc?

sorry for these basic questions but I didn't find any good starting point via google to read up on this matter (any links are welcome)

[till]

Please see here:

http://www.howtoforge.com/securing-y...-from-startssl

[erosbk]

Till, Falko, this is a great howto!!! very very very usefull!

I have an ISPConfig multiserver environment, is it possible to create a certificate for a mail server (postfix, courier) and with it give access to every vdomain that access the server using its own url??

for example, people can access mail server thgouth imap/pop3/smtp.virtualdomain.com.ar

I think I should generate a certificate for the server mail1.myenterprisedomain.com.ar but I don't know if the certificate could work this way!

Thanks

[falko]

This works only if you get a multi-domain certificate. And each time you want to add a domain you must buy a new cert. So it's better to tell your customers to use a specific hostname for mail or to abandon TLS (or live with certificate warnings).

[Ovidiu]

@Falko:

I finished reading that tutorial and was just about to ask the same question:

Do you really need to buy a new certificate every time you want to add a new domain to the multi-domain certificate?
I am asking because they actually make you pay for the verification process, the certificates are free but you need to verify your identity for the multi domain certs.

I'll ask them too if it would be possible to ask for a new free certificate every time I add a domain to my hosting portfolio or not.
If needed I'll get a certificate for my hxxxxx.stratoserver.net and have them all use that for accessing their emails.

[falko]

Originally Posted by Ovidiu

Do you really need to buy a new certificate every time you want to add a new domain to the multi-domain certificate?
I am asking because they actually make you pay for the verification process, the certificates are free but you need to verify your identity for the multi domain certs.

If you use StartSSL, I think you are right - you pay for verification once, and then you can get as many certs as you need for free within 350 days. But other CAs will make you pay for each new cert.