search

plesk / letsencrypt-plesk

Let’s Encrypt extension for Plesk gives all Plesk users the power to get a free Let’s Encrypt certificate with just a couple of clicks.
https://www.plesk.com/extensions/letsencrypt/
180 stars 25 forks source link

Let's Encrypt certificates don't work on mail in multiple domain servers #190

Open GeekTale opened 6 years ago

GeekTale commented 6 years ago

Hi.

I have a cloud server to hosting multiple webpages with a domain for each. I try to create Let's Encrupt certificates for each domain but this certificate doesn't work with the SMTP, POP3 or IMAP connections. All my clients works with Outlook or Thunderbird and this software thows error with the certificates. ¿Can be posible create a mail server certificate with all the domains names?

Thanks in advance.

acuntex commented 6 years ago

The issue goes further: If you enter an email address in a client (like thunderbird or on ios) the client assumes that the imap server is imap.domain.tld and the smtp is smtp.domain.tld.

If you use the lets encrypt certificate for domain.tld, users always get errors that the certificate is not ok because it's a different domain.

Since mail servers can only have one certificate you're basically stuck with this since the plesk addon does not yet allow aliases or wildcards (or the ui is not clear enough and I have no idea how to do it).

Anyway: How do other users do it? I'm always telling the users to use "domain.tld" but in 9/10 cases, they just f* up and use the standard mail client settings.

digitall-it commented 6 years ago

Also, the Plesk instructions to configure the email client do not suggest using as the server the secured address, but the domain. This leads to be unable to just point customers straight out to the documentation for client configuration.

marcomarsala commented 6 years ago

@digitall-it I reported that and they fixed the docs here: https://docs.plesk.com/en-US/onyx/administrator-guide/plesk-administration/securing-plesk/securing-plesk-and-the-mail-server-with-ssltls-certificates.59466/

"Note: If you secure the Plesk mail server with an SSL/TLS certificate, make sure to use the domain name for which the certificate was issued when connecting to the mail server, and advise your customers to do the same. Otherwise, the mail client software may be unable to verify the mail server identity, which may cause issues when sending or receiving mail."

A solution would be if only Plesk could generate multi-domain Let's Encrypt certificates.

digitall-it commented 6 years ago

Grazie, Marco.

sgalam commented 6 years ago

This is not a LE issue but a Plesk TLS SNI implementation issue on SMTP/IMAP/POP services.

see this: https://support.plesk.com/hc/en-us/articles/115002974174-Is-there-SNI-support-for-SMTP-IMAP-POP3-

https://plesk.uservoice.com/forums/184549-feature-suggestions/suggestions/32132116-it-would-be-nice-to-provide-mail-ssl-tls-support-w

pulsarinformatique commented 6 years ago

Hi This problem has been here for a while. Is the conclusion there is no solution ? Thanks

cyril

digitall-it commented 6 years ago

Plesk says it is a mailserver implementation issue, not theirs. But Dovecot has SNI support. So we should Uservoice it. https://plesk.uservoice.com/forums/184549-feature-suggestions/suggestions/32132116-it-would-be-nice-to-provide-mail-ssl-tls-support-w

pulsarinformatique commented 6 years ago

Hi I added my comment and vote on https://plesk.uservoice.com/forums/184549-feature-suggestions/suggestions/32132116-it-would-be-nice-to-provide-mail-ssl-tls-support-w

I'm surprised Plesk is waiting for this fix

pulsarinformatique commented 5 years ago

Hi Still no news on this vital requirement ? Very weird it hasn't been fixed already. Pleask is a great tool and this lacking feature is completely ununderstable.THANKS !