How Do I Configure Multiple Domains and SSLs With Postfix?

Type your comment> @Hifihedgehog said:

Step 1: Comment out the top two lines and add the follow lines to /etc/postfix/main.cf:


smtpd_tls_cert_file = /etc/pki/dovecot/certs/dovecot.pem

smtpd_tls_key_file = /etc/pki/dovecot/private/dovecot.pem

provide the primary certificate for the server, to be used for outgoing connections

smtpd_tls_chain_files =
/etc/letsencrypt/live/mail.yourprimarymailserverdomain.com/privkey.pem,
/etc/letsencrypt/live/mail.yourprimarymailserverdomain.com/fullchain.pem

provide the map to be used when SNI support is enabled

tls_server_sni_maps = hash:/etc/postfix/vmail_ssl.map

Step 2: Create the file /etc/postfix/vmail_ssl.map with the following:


Compile with postmap -F hash:/etc/postfix/vmail_ssl.map when updating

One host per line

mail.yourprimarymailserverdomain.com /etc/letsencrypt/live/mail.yourprimarymailserverdomain.com/privkey.pem /etc/letsencrypt/live/mail.yourprimarymailserverdomain.com/fullchain.pem
mail.yoursecondarymailserverdomain.com /etc/letsencrypt/live/mail.yoursecondarymailserverdomain.com/privkey.pem /etc/letsencrypt/live/mail.yoursecondarymailserverdomain.com/fullchain.pem

add more domains with keys and certs as needed


Step 3: Run postmap -F hash:/etc/postfix/vmail_ssl.map.

Step 4: Run systemctl restart postfix.

Step 5: Now test your domains’ SSLs! For each of your domains, run the following command: openssl s_client -connect localhost:25 -servername mail.mydomainname.com -starttls smtp

im getting example.com domains from ssl check

That means you did not select each of the domains in CyberPanel and generate an SSL certificate for those mail domains. That, or you tried regenerating the SSL certificate so many times that you are blocked out since you hit the renewal request quota, in which case you would have to wait.

Type your comment> @Hifihedgehog said:

That means you did not select each of the domains in CyberPanel and generate an SSL certificate for those mail domains. That, or you tried regenerating the SSL certificate so many times that you are blocked out since you hit the renewal request quota, in which case you would have to wait.

I solved that issue of generating ssl, my ssl is being shown rn but i still get ssl error for smtp i suppose for secondary domains.

My dovecot is:

local_name mail.s.com {
ssl_cert = </etc/letsencrypt/live/mail.s.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.s.com/privkey.pem
}

local_name mail.a.com.tr {
ssl_cert = </etc/letsencrypt/live/mail.a.com.tr/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.a.com.tr/privkey.pem
}

local_name mail.y.com {
ssl_cert = </etc/letsencrypt/live/mail.y.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.y.com/privkey.pem
}

My postfix vmail is

mail.y.com /etc/letsencrypt/live/mail.y.com/privkey.pem /etc/letsencrypt/live/mail.y.com/fullchain.pem
mail.s.com /etc/letsencrypt/live/mail.s.com/privkey.pem /etc/letsencrypt/live/mail.s.com/fullchain.pem
mail.a.com.tr /etc/letsencrypt/live/mail.a.com.tr/privkey.pem /etc/letsencrypt/live/mail.a.com.tr/fullchain.pem

my main.cf is

smtpd_use_tls = yes
#smtpd_tls_cert_file = /etc/pki/dovecot/certs/dovecot.pem
#smtpd_tls_key_file = /etc/pki/dovecot/private/dovecot.pem
smtpd_tls_chain_files =
/etc/letsencrypt/live/mail.y.com/privkey.pem,
/etc/letsencrypt/live/mail.y.com/fullchain.pem

provide the map to be used when SNI support is enabled

tls_server_sni_maps = hash:/etc/postfix/vmail_ssl.map
virtual_create_maildirsize = yes
virtual_maildir_extended = yes

configured like this. I generated ssl and mailserver ssl for mail.y.com from panel and checked the ssl certs.

used postmap -F hash:/etc/postfix/vmail_ssl.map , systemctl restart postfix and systemctl restart dovecot without errors.

Nothing wrong with certifications but i still get error on gmail mobile. If youre willing to take a look at cfgs i can hand them over. This mail problem hurts my head so much last few days …

Sorry, I can’t offer direct troubleshooting services at this time, but what I can say is if you are seeing example.com certificates in your mail client (in this case, Gmail) and SSL check, then they did not renew properly. Check your CyberPanel log. It may say it renewed at the SSL renewal tool in CyberPanel, but it may have actually failed. I would venture to guess that checking your logs would be the next best course of action.

It shows three thousand something years on ssl remaining time when it fails, i checked it and its 90 days right now. Don’t think it is the ssl.

That is the placeholder SSL which means there is a typo somewhere down the line or the SSL didn’t renew. Keep combing through it and plugging away and it will eventually become evident what the root of the problem is.

I have tried lots of possible configurations and it only gets worse. Now i get ssl errors both for imap and smtp connections. It says certificate subject does not match machine or server name. My main mailserver domains ssl shows below with mail.y.com lets encrypt etc… and my mail adress belongs to that domain also, its not even a different domain. Before this postfix change atleast i could make main domains emails work properly. Now everything is a mess. Don’t know how other people handle this … ( Even for domains that i created after 1.9.4 update does not work )

Yeah, you messed up royally somewhere. As always, there is an element of risk involved with any of these mods or tweaks unless you know exactly what you are doing.

Information from this article is extracted and inserted into original article at → 6 - Self-signed SSL error on Outlook/Thunderbird - 06 - Email - CyberPanel Community

Also added note on top of this thread.

Is there any update as to when we will be able to use multiple websites/domains with their respective emails and if it was updated, is there a place where I can read about how to set it up? I tried adding a website, created an email, sent the mail and it got blocked my gmail right away.

This topic was automatically closed 3 hours after the last reply. New replies are no longer allowed.