Server Name Indication (SNI) is a TLS extension that enables a server to present different certificates based on the hostname requested by the client during the TLS handshake.
In modern email environments, multiple domains frequently share the same IP address for SMTP, IMAP, POP3 and submission services. Without SNI, a mail server can expose only a single certificate per listening socket, forcing administrators to rely on multi-domain (SAN) certificates or wildcard certificates. This approach increases operational problems among unexperienced end users, who are unable to use the client wizards to correctly configure their mailboxes.
Enabling SNI in mail services allows the server to present the appropriate certificate based on the hostname requested by the client, contained in its email address.
The SNI support for my qmail distribution has been added by Andreas Gerstlauer (commits here and here), whom I would like to thank.
Adding the certificates
In qmail, domain-specific SSL certificates for servers that are reachable under different names when the client supports SNI have to be set into
QMAILDIR/control/servercerts/<FQDN>/servercert.pem
QMAILDIR/control/servercert.pem is used as default, when an appropriate certificate for the required hostname cannot be found on the server.
Concerning dovecot, you need to declare the additional certificates for SNI in the following way:
local_name domain2.tld {
ssl_server_cert_file = /etc/dehydrated/certs/domain2.tld/fullchain.pem
ssl_server_key_file = /etc/dehydrated/certs/domain2.tld/privkey.pem
}
local_name *.domain2.tld {
ssl_server_cert_file = /etc/dehydrated/certs/domain2.tld/fullchain.pem
ssl_server_key_file = /etc/dehydrated/certs/domain2.tld/privkey.pem
}
The above settings for dovecot will be added for you by the hook script.
SNI certificate setup and qmail, Dovecot and Apache configuration will be discussed on the next page.
Testing the certificate
In the following domain.tld is a domain for which we want to test SNI. To test SNI with openssl you have to pass the -servername option.
openssl s_client -starttls smtp -connect serverIP:587 -servername domain.tld 2>/dev/null | grep subject=CN
Basically, you are connecting to the mail server's IP and asking for a certificate for the domain domain.tld. If the server doesn't ship any certificate for domain.tld, then the default one will be served, which is /var/qmail/control/servercert.pem.
At the end of the certificate you have the Common Name (CN):
subject=CN = domain.tld
which is the FQDN for which the certificate has been released. If you get domain.tld or smtp.domain.tld or any domain having domain.tld as a secondary level domain, then your SNI is working and your client is able to indicate the certificate related to the domain it is connecting from.
Same example for IMAP and POP3 protocols:
# openssl s_client -connect serverIP:995 -servername domain.tld 2>/dev/null | grep subject=CN subject=CN = domain.tld # openssl s_client -connect serverIP:993 -servername domain.tld 2>/dev/null | grep subject=CN subject=CN = domain.tld
The SAN (Subject Alternative Name) of the certificate is the list of the domains which are protected by the same certificate:
# openssl x509 -in /var/qmail/control/servercerts/domain.tld/servercert.pem -noout -text | grep -A1 "Subject Alternative Name" X509v3 Subject Alternative Name: DNS:domain.tld, DNS:smtp.domain.tld, DNS:imap.domain.tld, DNS:pop3.domain.tld,
You can get the SAN when connecting from remote in the following way:
openssl s_client -starttls smtp -connect domain.tld:587 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alternative Name"
