PROBLEM

How do i use multiple SSL certs for Dovecot and Exim?

ENVIRONMENT

On-Premises Server: Version 7.7+

CAUSE
Default configurations only allow for one pair of SSL certificates.

PRESUMPTIONS

Two or more domains requiring SSL certificates. This document will use the following domains for our examples:

dog.com
fish.com

If you would like to use self-signed certificates, these can be generated using this documentation.

RESOLUTION

⚠ Note: The multi-cert implementation will only work with clients whom advertise SNI. Otherwise the default certificate will be provided by the server.

For my certs, i have used the form of domain.com.key/pem.

Please take note of the following permissions and ownerships.

Contents and naming conventions for private/*.key.

permissions = chmod 644 dog.com.pem
ownership = chown atmail:root dog.com.pem

[root@7802 ~]# ll /usr/local/atmail/mailserver/ssl/private/
total 20
-rw-r--r-- 1 atmail root 1675 May 18 12:30 dog.com.key
-rw------- 1 atmail root  912 May 16 08:04 dovecot.key
-rw-r--r-- 1 atmail root 1679 May 18 12:17 fish.com.key
-rw-r--r-- 1 atmail root  951 May 16 08:01 smtp.key
-rw-r--r-- 1 atmail root  887 May 16 08:01 smtpserver.key

Contents and naming conventions for certs/*.pem.

[root@7802 ~]# ll /usr/local/atmail/mailserver/ssl/certs/
total 12
-rw-r--r-- 1 atmail root 1350 May 18 12:30 dog.com.pem
-rw-r--r-- 1 atmail root 1046 May 16 08:04 dovecot.pem
-rw-r--r-- 1 atmail root 1350 May 18 12:16 fish.com.pem

Exim

Open your Exim configuration:

[root@7802 ~]# vi /usr/local/atmail/mailserver/configure

Find the following section:

#<TLSSMTP>
# Enable Exim TLS
tls_advertise_hosts = *
log_selector = +all
tls_certificate=/usr/local/atmail/mailserver/ssl/certs/dovecot.pem
tls_privatekey=/usr/local/atmail/mailserver/ssl/private/dovecot.key
#</TLSSMTP>

Change to:

#<TLSSMTP>
# Enable Exim TLS
tls_advertise_hosts = *
log_selector = +all
tls_privatekey = ${if exists{/usr/local/atmail/mailserver/ssl/private/${tls_sni}.key}{/usr/local/atmail/mailserver/ssl/private/${tls_sni}.key}{/usr/local/atmail/mailserver/ssl/private/dovecot.key}}
tls_certificate = ${if exists{/usr/local/atmail/mailserver/ssl/certs/${tls_sni}.pem}{/usr/local/atmail/mailserver/ssl/certs/${tls_sni}.pem}{/usr/local/atmail/mailserver/ssl/certs/dovecot.pem}}
#</TLSSMTP>

Dovecot

Open your dovecot configuration:

[root@7802 ~]# vi /usr/local/atmail/mailserver/etc/dovecot/dovecot.conf

Find the following section:

#<DOVECOT_SSL_CERT>
ssl_cert = </usr/local/atmail/mailserver/ssl/certs/dovecot.pem
ssl_key = </usr/local/atmail/mailserver/ssl/private/dovecot.key
#</DOVECOT_SSL_CERT>

#<SSL_DISABLE>
ssl = yes
#</SSL_DISABLE>

Change to represent the below. Each domain requires specification of cert and keys:

#<DOVECOT_SSL_CERT>
local_name dog.com {
  ssl_cert = </usr/local/atmail/mailserver/ssl/certs/dog.com.pem
  ssl_key = </usr/local/atmail/mailserver/ssl/private/dog.com.key
}
local_name fish.com {
  ssl_cert = </usr/local/atmail/mailserver/ssl/certs/fish.com.pem
  ssl_key = </usr/local/atmail/mailserver/ssl/private/fish.com.key
}
ssl_cert = </usr/local/atmail/mailserver/ssl/certs/dovecot.pem
ssl_key = </usr/local/atmail/mailserver/ssl/private/dovecot.key
#</DOVECOT_SSL_CERT>

#<SSL_DISABLE>
ssl = yes
#</SSL_DISABLE>

Save configuration and restart atmail:

[root@7802 ~]# /etc/init.d/atmailserver restart

Testing

Check the services are running:

[root@7802 ~]# ss -tlpn | grep "143\|587"
LISTEN     0      20           *:587                      *:*                   users:(("exim",pid=2649,fd=5))
LISTEN     0      100          *:143                      *:*                   users:(("dovecot",pid=2654,fd=39))
LISTEN     0      100         :::143                     :::*                   users:(("dovecot",pid=2654,fd=40))

While testing, it may be helpful to tail the corresponding logs:

Exim: tail -f /usr/local/atmail/mailserver/spool/log/mainlog
Dovecot: tail -f /usr/local/atmail/mailserver/spool/log/dovecot_info_log

Testing Exim

fish.com

$ openssl s_client -starttls smtp -crlf -connect 192.168.10.184:587 -servername fish.com -tlsextdebug
CONNECTED(00000003)

TRUNCATED OUTPUT....

Certificate chain
 0 s:/C=AU/ST=QLD/L=PB/O=11/OU=11/CN=7802/emailAddress=admin@fish.com
   i:/C=AU/ST=QLD/L=PB/O=11/OU=11/CN=7802/emailAddress=admin@fish.com

dog.com

$ openssl s_client -starttls smtp -crlf -connect 192.168.10.184:587 -servername dog.com -tlsextdebug
CONNECTED(00000003)

TRUNCATED OUTPUT....

Certificate chain
 0 s:/C=AU/ST=WOOF/L=BORK/O=BARK/OU=RUFF/CN=GROWL/emailAddress=HOWL@WOOF.com
   i:/C=AU/ST=WOOF/L=BORK/O=BARK/OU=RUFF/CN=GROWL/emailAddress=HOWL@WOOF.com

no domain specified

Server provides default dovecot.pem/key

$ openssl s_client -starttls smtp -crlf -connect 192.168.10.184:587 -tlsextdebug 
CONNECTED(00000003)

TRUNCATED OUTPUT....

Certificate chain
 0 s:/C=MW/ST=Earth/L=City/O=Automatically-generated SSL/OU=IMAP server/CN=localhost/emailAddress=postmaster@localhost
   i:/C=MW/ST=Earth/L=City/O=Automatically-generated SSL/OU=IMAP server/CN=localhost/emailAddress=postmaster@localhost

Testing Dovecot