I have a CentOS 7 server that is running Exim and Dovecot for communicating on SMTP and POP3 ports. I want to configure them to use TLS to encrypt all data. I have already figured how to change the config files of Exim and Dovecot, but there is one problem: the certificates I intended to use are self-signed and it seems that gmail does not accept SSL certificates that are self-signed.

Now I want to buy a DV SSHL certificate from a trusted authority, but I don't know which subdomain I should buy it for. My DNS records include an MX record that says "10 mail" and then it is assigned to the IP address of my server. I don't know what 10 means there, but I suppose that means mail.domain.tld is the address of my mail server. Right?

So, here are my questions:

  1. Should I get a certificate for mail.domain.tld?
  2. Can I use my certificate for domain.tld which has been issued by a trusted authority?
  3. Can I get a certificate for an IP address instead of a FQDN? Will that work with gmail too?
  • 1
    I don't have an answer, but wanted to point out that the 10 is the MX record "priority". More info: serverfault.com/questions/178041/mx-record-priorities – Maximillian Laumeister Jan 30 '20 at 19:46
  • Another thing to note is that "regular" DV certificates don't work for email, you need to get a special "email" certificate from a CA that's set up to sign those. – Maximillian Laumeister Jan 30 '20 at 19:50
  • @MaximillianLaumeister Thanks. Do you happen to know what kind of certificate I should buy, if not a regular DV certificate? Should it be an EV certificate? There are lots of names out there for SSL certificates and they cost differently. So, I'm really confused. – stressed out Jan 30 '20 at 20:53
  • I'm pretty certain that neither a standard DV nor standard EV cert will work. It has to be a different kind of cert that's specifically for stuff like email, not for a website. I would be searching for "email ssl certificate" rather than just "ssl certificate". – Maximillian Laumeister Jan 30 '20 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.