Docker-mailserver: Multi domain SSL with manual mode

[ShuP1]

Context

I use a mail server with two domains (a.tld & z.tld). (see environment)
Others certs are in /tmp/ssl/z.tld/

Expected Behavior

Use correct SSL certs on both domains.

Actual Behavior

a.tld works but z.tld use a.tld cert and so is invalid.

Possible Fix

Setup proper SSL on both domains with pattern or SSL_CERT_PATH_z.tld.

Steps to Reproduce

1. Add a second domain
2. Setup manual SSL cert

Your Environment

    - SSL_TYPE=manual
    - SSL_CERT_PATH=/tmp/ssl/a.tld/a.tld.crt
    - SSL_KEY_PATH=/tmp/ssl/a.tld/a.tld.key

[fbartels]

I don't think that postfix/dovecot have a means to detect which domain you are trying to access it over (for https connections the technique used is sni). But technically this is also not necessary, the mailserver can be reachable by a completely different domain, than the mailbox domains it serves.

[erik-wramner]

Just to elaborate on @fbartels answer the common setup is to have a single certificate for the mail server and reference the same mail server host with MX records from multiple domains. The mail server does not have to be part of any of the domains though it could be. So you could have mail.a.tld as MX record for both a.tld and z.tld. Using the same port and IP address for multiple domains with different certificates is not supported and not really needed.

[muellni]

To note down my findings on this issue: A very recent postfix has SNI support:
http://www.postfix.org/postconf.5.html#tls_server_sni_maps
and Dovecot also seems to have SNI support:
https://wiki.dovecot.org/SSL/DovecotConfiguration#With_client_TLS_SNI_.28Server_Name_Indication.29_support

So I guess this _could_ be implemented, but I guess I'll stick to the single MX record solution for now.

[erik-wramner]

Interesting. You would need to have mail clients and remote mail servers that are up to date as well for this you work, though. I would think twice before using it on my servers!

The current version of the image uses an old Debian version and hence a somewhat older version of Postfix, so this should go in the new branch for the latest Debian version when/if it is implemented.