This may be a really stupid question, but I can't seem to put my head around it. I have a mail server I'm trying to setup to service 6 domains. I will have multiple mail users accessing the server via POP3S or IMAPS.Currently in MS Outlook, they are receiving an unverified SSL cert warning because I'm using a self-signed SSL certificate. I would like to purchase a SSL cert which would stop this warning from appearing.Here is my question. I want each domain group to use something like mail.theirdomain.com as the incoming mail server name. Is there a way to do this without having to purchase a cert for each of the 6 domains? In other words, can I buy one for the mail.maindomain.com and have it authenticate the other DNS names?Currently in DNS, the mail.theirdomain.com has a CNAME setup to mail.maindomain.com. I'm running Dovecot for incoming and Sendmail for outgoing. Latest version on Debian 6.
Dovecot POP3S & IMAPS SSL Certificate that works for all user domains
ssl;certificates;imap;dovecot
I have used multiple domain certificates, but only in cases where the names are variant domains the same organization.  Ownership of the names trace back to the same corporation.   If I were a certificate authority, I would not want to provide the same service for unrelated organizations. For SMTP, it is not unusual for the domain of the mail server to be different than the domain which is originating mail.  Dovecot supports domain logins, so that you have have users log in with ids like John.Doe@example.com while using a single domain for the Dovecot server.  You would still just need certificate signed by a recognized certificate authority.You could also do as I do, and publish the public key of your signing certificate.  Your clients could then import the key, and the certificate will pass if the domain matches.  I haven't tried adding alternate names to a self-signed certificate, but it appears that openssl will generate such certificates fairly easily. 