Index: [Article Count Order] [Thread]

Date:  Sun, 1 Oct 2006 08:57:45 -0400
From:  Patrick Giagnocavo <patrick (at mark) zill.net>
Subject:  [coba-e:07325] Re: Dovecot SSL warning (not error)
To:  coba-e (at mark) bluequartz.org
Message-Id:  <d689dbd7f906c69fb4ee334a97271e08 (at mark) zill.net>
In-Reply-To:  <20061001111442.GA99318 (at mark) xs4all.nl>
References:  <451B8BC5.4090106 (at mark) enavn.com> <451BEC94.6079.FFFA36 (at mark) localhost> <20061001111442.GA99318 (at mark) xs4all.nl>
X-Mail-Count: 07325

>
> Indeed. However, my users have another problem with the certificate.
> When they are connecting with POPS to their own virtual domainname, 
> they
> receive a security warning that the certificate's domainname is 
> different
> from the domainname they are connecting to. The certificate's 
> domainname
> is the name from the box.
>

If I understand you correctly, you have more than one domain on this 
system.

That is, the main domain might my myhosting.com ; but you have a 
customer that has customerdomain.com .

Then, the customer's mail setting is mail.customerdomain.com when they 
get the SSL warning.  If the customer uses mail.myhosting.com (as an 
example) then they do not get the warning.

Is this correct?

> When the client uses the box's name as their POPS server, there
> is no warning. Anyone know of a way to get rid of the warning while 
> still
> using the client's domainname as the POPS server?
>

If the above scenario is true, then the answer is "no".

The reason is that SSL's design means that the encryption information 
is sent before the hostname information can be read.  Therefore, you 
can use only one SSL cert per IP address.

If you are willing to dig around via the command line, you might be 
able to add a second IP for the customer's use, and then configure an 
SSL cert to be used on that IP.  That might work, though I don't have 
any experience with that.

Cordially
Patrick Giagnocavo
patrick (at mark) zill.net
BQ-based dedicated servers from $79/month