Download Overview

CONFIGURATION : SSL CERTIFICATE (CONT.)
5.Select the certificate file and private key filed
6.Save the changes
After following these steps, hMailServer knows about the SSL certificate, but you also need
to tell hMailServer when to use it.
Configuring hMailServer to use the SSL certificate
1.Start hMailServer Administrator
2.Navigate to Settings->Advanced->TCP/IP ports
3.Select a port
4.Select “Use SSL” and the certificate.
5.Save the changes
6.Restart hMailServer
This will have the effect that all traffic sent on this port will be encrypted using the
certificate. Normally you want to add an additional TCP/IP port in the hMailServer
and select to use SSL for that port. Note that all clients connecting to the port must be
configured to use SSL.
Configuring Clients
After having configured hMailServer to use SSL certificates, you must configure the clients
to do it as well. This typically involves opening the account settings in the email client and
selecting that the server uses SSL.
If you want SMTP communication between you and your users to be encrypted, you
must configure the TCP/IP port for SMTP to use SSL. However, since other e-mail servers
delivering email to hMailServer will not know that you require SSL, you typically must
create a second TCP/IP port for SMTP, configure it to use SSL. After that, you need to
reconfigure clients to connect to the new TCP/IP port and to use SSL. This way, other email
servers will continue delivering email unencrypted on port 25, while your users will deliver
email to you on a secondary port.
Recommendations
It’s recommended that you use a RSA key.
Security Considerations
When hMailServer connects to another server using SSL (during a SMTP delivery or
download from an external account), it does not verify the servers SSL certificate. This
means that the the communication between the client and server is crypted and hence
less open for eavesdropping than an unencrypted connections. But it is still vulnerable to a
man in the middle attack since hMailServer does not verify that it is actually talking to the
correct server.
Page 84