STARTTLS impossible with caddy-net with TLS?

[etique57]

Hello,

Not really an issue, but just a confirmation that I'm doing things right and not messing things up!

I want to use caddy as a frontend server, redirecting everything that gets inside my network (after passing my router), and also centralizing the management of SSL certificates for my domain. (I actually have two caddy instances, one type=http & one type=net, sharing the same certificates).

I have a maildock instance, that was, until then, referring the SSL certs for the starttls connection for IMAP.

Now that I started my frontend instance of caddy-net, I figured that I had to reconfigure my STARTTLS IMAP connection to a SSL imap connection (still using the IMAP port, i.e. 143, though by default it should be 993).

Here's my configuration:

proxy :143 maildock:143 {
  host mydomain.net
  tls webmaster@mydomain.net
}

Is it ok or am I doing something wrong?

To me, the difference in my layman terms is the following:

• with starttls, the unencrypted dialog with IMAP starts, and then the tunnel is created
• with caddy-net, the dialog needs to be first encrypted.

The only problem is that now, it is possible to access the IMAP server directly in cleartext from my network, which for me is not a big issue.