Articles in this section

How to assign an SSL certificate per domain to secure the mail server in Plesk (SNI support)?

Vincent Lauton
Updated
ext: le Plesk Obsidian for Linux Plesk Obsidian for Windows ABT: Group B kb: auxiliary

Applicable to:

  • Plesk Obsidian for Linux
  • Plesk Obsidian for Windows

Question

How to assign an SSL certificate per domain to secure the mail server in Plesk (SNI support)?

Answer

Requirements

Plesk Mail Server Operating System
Plesk Obsidian for Windows MailEnable 10.20 and above

All currently supported operating systems
Plesk Obsidian for Linux Postfix + Dovecot

All currently supported operating systems

Warning: If you're switching from Courier to Dovecot be aware of potential issues.

  1. Log into Plesk

  2. Issue a Let's Encrypt certificate for a domain, or upload a paid certificate

  3. For each of the domains that should have a separate mail certificate, navigate to Domains > example.com > Mail > Mail Settings

  4. Select the domain's certificate in SSL/TLS certificate for mail dropdown:

    mceclip0.png

  5. Click on Apply

  6. Verify that the separate mail certificate is used:

    • On Windows:

      1. Connect to the server via RDP

      2. Run OpenSSL with the mail server's domain and check the certificate's CN field:

        PS echo 'Q' | plesk sbin openssl s_client -connect localhost:465 -servername example.com -showcerts 2>&1 | SLS -Pattern 'CN=[^/]+' | % { $_.Matches } | % { $_.Value } | Get-Unique
        CN=example.com

    • On Linux:

      1. Connect to the server via SSH

      2. Run OpenSSL with the mail server's domain and check the certificate's CN field:

        # echo 'Q' | openssl s_client -connect localhost:465 -servername example.com -showcerts 2>&1 | grep -Eo 'CN=[^/]+' | uniq
        CN=example.com

Was this article helpful?

Comments

1 comment
Date Votes
  • Avatar
    Ilya Ladygin
    (Edited )

    this command didn't worked for me: 

    echo 'Q' | openssl s_client -connect localhost:465 -servername example.com -showcerts 2>&1 | grep -Eo 'CN=[^/]+' | uniq

    i have to modify this part: grep -Eo 'CN=[^/]+' into grep -Eo 'CN\s*=[^/]+' because of space char before "="

    also, new command:

    echo 'Q' | openssl s_client -connect localhost:465 -servername example.com -showcerts 2>&1 | grep -Eo 'CN\s*=[^/]+' | uniq

     

    0

Please sign in to leave a comment.