Hello Timo,
I'd like to check if my understanding of dovecot-1.2.x's SSL certificate
handling is correct :
SSL does not provide the server any mechanism to choose which certificate
it must send relatively to the name the client is using. Thus, if you want
to
use different certificates, you have to listen to different addresses. This
is
an SSL limitation, not a dovecot nor IMAP limitation.
This is the reason why it's possible to use different certificates for IMAP
and POP3. But it seems to work only with those two :
As a matter of fact, even if you listen to different addresses, how would
you tell dovecot to send this certificate for this address and that
certificate
for that address, since there is no IP dependent section (as in apache
IP-based
virtual host for instance) ? It seems the only way would be to have more
than
one instance of dovecot (several dovecot with different config files).
The problem is that some clients may be configured with mail.my.domain, some
others with imap.my.domain, ...etc... Hence the need to have different
certificates with those different names as cn.
--
Thomas Hummel | Institut Pasteur
<hum...@pasteur.fr> | Pôle informatique - systèmes et réseau
