imaps with stunnel and multiple virtual hosts/certificates

[thomashe]

The wiki describes how to use stunnel with one certificate file to enable imaps/pop3s etc.

I have configured Scalix to accept emails for multiple domains: domain-1.com, domain-2.de and domain-3.eu. For all of the 3 domains i have certificates. I don't want to purchase a certificate for a number of domains so i'm using the simple "one-domain only" StartSSL certificates.

Configuring the apache/https and webmail works using GnuTLS (server name indication).

Unfortunately i can only assign one certificate within stunnel configuration, means i can't benefit from the server name indication functionality that is supported by GnuTLS. As consequence i assume that the secure communication will only work with one domain and the others (not included in the stunnel configured certificate) will trigger a certificate error during secure communication setup.

Is there any alternative of stunnel to support server name indication with imaps/pop3s ?

[thomashe]

... works now with the latest version of stunnel (4.5.2) if stunnel is compiled with openssl 1.0.0

here my stunnel.conf that works fine:

Code: Select all

pid = /var/run/stunnel/stunnel.pid

;change to debug = 4 after verification!
debug = 7
output = /var/log/stunnel/stunnel.log

[pop3s]
cert = /etc/httpd/keys/my-domain.com/ssl_gnutls.crt
key = /etc/httpd/keys/my-domain.com/server.key
accept  = 995
connect = 110

[sni1]
sni = pop3s:my-domain.com
cert = /etc/httpd/keys/my-domain.com/ssl_gnutls.crt
key = /etc/httpd/keys/my-domain.com/server.key
connect = 110

[sni2]
sni = pop3s:another-domain.de
cert = /etc/httpd/keys/another-domain.de/ssl_gnutls.crt
key = /etc/httpd/keys/another-domain.de/server.key
connect = 110

[sni3]
sni = pop3s:another-domain.eu
cert = /etc/httpd/keys/another-domain.eu/ssl_gnutls.crt
key = /etc/httpd/keys/another-domain.eu/server.key
connect = 110

[imaps]
cert = /etc/httpd/keys/my-domain.com/ssl_gnutls.crt
key = /etc/httpd/keys/my-domain.com/server.key
accept  = 993
connect = 143

[sni4]
sni = imaps:my-domain.com
cert = /etc/httpd/keys/my-domain.com/ssl_gnutls.crt
key = /etc/httpd/keys/my-domain.com/server.key
connect = 143

[sni5]
sni = imaps:another-domain.de
cert = /etc/httpd/keys/another-domain.de/ssl_gnutls.crt
key = /etc/httpd/keys/another-domain.de/server.key
connect = 143

[sni6]
sni = imaps:another-domain.eu
cert = /etc/httpd/keys/another-domain.eu/ssl_gnutls.crt
key = /etc/httpd/keys/another-domain.eu/server.key
connect = 143

[ssmtp]
cert = /etc/httpd/keys/my-domain.com/ssl_gnutls.crt
key = /etc/httpd/keys/my-domain.com/server.key
accept  = 465
connect = localhost:587

[sni7]
sni = ssmtp:my-domain.com
cert = /etc/httpd/keys/my-domain.com/ssl_gnutls.crt
key = /etc/httpd/keys/my-domain.com/server.key
connect = localhost:587

[sni8]
sni = ssmtp:another-domain.de
cert = /etc/httpd/keys/another-domain.de/ssl_gnutls.crt
key = /etc/httpd/keys/another-domain.de/server.key
connect = localhost:587

[sni9]
sni = ssmtp:another-domain.eu
cert = /etc/httpd/keys/another-domain.eu/ssl_gnutls.crt
key = /etc/httpd/keys/another-domain.eu/server.key
connect = localhost:587

[uals]
cert = /etc/httpd/keys/my-domain.com/ssl_gnutls.crt
key = /etc/httpd/keys/my-domain.com/server.key
accept = 5767
connect = 5729