hmLoadTopic({
hmKeywords:"Certificates,Certificates SSL,Certificates Using third-party,Certificates Webmail,Creating and Using SSL Certificates,Let\'s Encrypt,MDaemon CA,Secure Sockets Layer protocol,SSL & Certificates,SSL Certificates,Third-party Certificates,Webmail,Webmail SSL & Certificates",
hmTitle:"Creating and Using SSL Certificates",
hmDescription:"When using the SSL & TLS dialog to create certificates, MDaemon generates certificates that are self-signed. In other words, the issuer of the certificate, or Certificate...",
hmPrevLink:"route_slips.html",
hmNextLink:"ssl_creating_and_using_ssl_certifi.html",
hmParentLink:"index.html",
hmBreadCrumbs:"",
hmTitlePath:"Creating and Using SSL Certificates",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">Creating and Using SSL Certificates<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText\"><span class=\"f_BodyText\">When using the SSL &amp; TLS dialog to create certificates, MDaemon generates certificates that are self-signed. In other words, the issuer of the certificate, or Certificate Authority (CA), is the same as the owner of the certificate. This is perfectly valid and allowed, but because the CA won\'t already be listed in yours users<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_BodyText\"> lists of trusted CAs, whenever they connect to Webmail or Remote Administration<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_BodyText\">s HTTPS URL, they will be asked whether or not they wish to proceed to the site and\/or install the certificate. Once they agree to install the certificate and trust your Webmail<\/span><span style=\"font-family: \'Times New Roman\',Times,Georgia,serif; color: #010100;\">\'<\/span><span class=\"f_BodyText\">s domain as a valid CA they will no longer have to see the security alert message when connecting to Webmail or Remote Administration.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">When connecting to MDaemon via a mail client such as Microsoft Outlook, however, they will not be given the option to install the certificate. They will be allowed to choose whether or not they wish to continue using the certificate temporarily, even though it isn\'t validated. Each time they start their mail client and connect to the server, they will have to choose to continue using the non-validated certificate. <\/span><span class=\"f_BodyText\">To avoid this you can either obtain a certificate from a Certificate Authority, such as <\/span><span class=\"f_BodyText\"><a href=\"ssl_lets-encrypt.html\" class=\"topiclink\" title=\"Let\'s Encrypt\">Let\'s Encrypt<\/a>, or you can export your self-signed certificate and distribute it to your users via email or some other means. Then, they can manually install and trust your certificate to avoid future warning messages.<\/span><\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><a id=\"creatingacertificate\" class=\"hmanchor\"><\/a><span class=\"f_Heading2\">Creating a Certificate<\/span><\/h2>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">To create a certificate from within MDaemon:<\/span><\/p>\n\r<p class=\"p_List1\" style=\"text-indent: 0; padding-left: 1.6875rem; margin-left: 2.0625rem;\"><span class=\"f_List1\" style=\"display:inline-block;width:1.6875rem;margin-left:-1.6875rem\">1.<\/span><span class=\"f_List1\">Move to the SSL &amp; TLS dialog within MDaemon (click <\/span><span class=\"f_List1\" style=\"font-weight: bold;\">Security » Security Settings » SSL &amp; TLS » MDaemon<\/span><span class=\"f_List1\">).<\/span><\/p>\n\r<p class=\"p_List1\" style=\"text-indent: 0; padding-left: 1.6875rem; margin-left: 2.0625rem;\"><span class=\"f_List1\" style=\"display:inline-block;width:1.6875rem;margin-left:-1.6875rem\">2.<\/span><span class=\"f_List1\">Check the box labeled, <\/span><span class=\"f_List1\" style=\"font-weight: bold;\">Enable SSL, STARTTLS, and STLS<\/span><span class=\"f_List1\">.<\/span><\/p>\n\r<p class=\"p_List1\" style=\"text-indent: 0; padding-left: 1.6875rem; margin-left: 2.0625rem;\"><span class=\"f_List1\" style=\"display:inline-block;width:1.6875rem;margin-left:-1.6875rem\">3.<\/span><span class=\"f_List1\">Click <\/span><span class=\"f_List1\" style=\"font-weight: bold;\">Create Certificate<\/span><span class=\"f_List1\">.<\/span><\/p>\n\r<p class=\"p_List1\" style=\"text-indent: 0; padding-left: 1.6875rem; margin-left: 2.0625rem;\"><span class=\"f_List1\" style=\"display:inline-block;width:1.6875rem;margin-left:-1.6875rem\">4.<\/span><span class=\"f_List1\">In the text box labeled, <\/span><span class=\"f_List1\" style=\"font-weight: bold;\">Host name<\/span><span class=\"f_List1\">, enter the domain to which the certificate belongs (for example, &quot;<\/span><span class=\"f_List1\" style=\"font-style: italic;\">mail.example.com<\/span><span class=\"f_List1\">&quot;).<\/span><\/p>\n\r<p class=\"p_List1\" style=\"text-indent: 0; padding-left: 1.6875rem; margin-left: 2.0625rem;\"><span class=\"f_List1\" style=\"display:inline-block;width:1.6875rem;margin-left:-1.6875rem\">5.<\/span><span class=\"f_List1\">Type the name of the organization or company that owns the certificate into the text box labeled, &quot;<\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-style: italic; color: #010100;\">Organization\/company name<\/span><span class=\"f_List1\">&quot;.<\/span><\/p>\n\r<p class=\"p_List1\" style=\"text-indent: 0; padding-left: 1.6875rem; margin-left: 2.0625rem;\"><span class=\"f_List1\" style=\"display:inline-block;width:1.6875rem;margin-left:-1.6875rem\">6.<\/span><span class=\"f_List1\">In &quot;<\/span><span style=\"font-family: Arial,Helvetica,sans-serif; font-style: italic; color: #010100;\">Alternative host names...<\/span><span class=\"f_List1\">,&quot; type all other domain names that your users will be using to access your server (for example, &quot;<\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">*.example.com<\/span><span class=\"f_List1\">&quot;, &quot;<\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">example.com<\/span><span class=\"f_List1\">&quot;, &quot;<\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">mail.altn.com<\/span><span class=\"f_List1\">&quot;, and so on).<\/span><\/p>\n\r<p class=\"p_List1\" style=\"text-indent: 0; padding-left: 1.6875rem; margin-left: 2.0625rem;\"><span class=\"f_List1\" style=\"display:inline-block;width:1.6875rem;margin-left:-1.6875rem\">7.<\/span><span class=\"f_List1\">Choose a length for the encryption key from the drop-down list box.<\/span><\/p>\n\r<p class=\"p_List1\" style=\"text-indent: 0; padding-left: 1.6875rem; margin-left: 2.0625rem;\"><span class=\"f_List1\" style=\"display:inline-block;width:1.6875rem;margin-left:-1.6875rem\">8.<\/span><span class=\"f_List1\">Choose the Country\/region where your server resides.<\/span><\/p>\n\r<p class=\"p_List1\" style=\"text-indent: 0; padding-left: 1.6875rem; margin-left: 2.0625rem;\"><span class=\"f_List1\" style=\"display:inline-block;width:1.6875rem;margin-left:-1.6875rem\">9.<\/span><span class=\"f_List1\">Click <\/span><span style=\"font-family: \'Microsoft Sans Serif\'; font-weight: bold; color: #010100;\">OK<\/span><span class=\"f_List1\">.<\/span><\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><a id=\"usingcertificatesissuedby\" class=\"hmanchor\"><\/a><span class=\"f_Heading2\">Using Certificates Issued by a Third-party CA<\/span><\/h2>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">If you have purchased or otherwise generated a certificate from some source other than MDaemon, you can still use that certificate by using the Microsoft Management Console to import it into the certificate store that MDaemon uses. To do so in Windows XP:<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 1.0000rem 1.5625rem;\"><table style=\"border:none;border-spacing:0;padding:0;line-height: normal;\"><tr style=\"vertical-align:baseline\"><td style=\"border:none;padding:0;width:1.4375rem\"><span class=\"f_ControlIndent\">1.<\/span><\/td><td style=\"border:none;padding:0\"><span class=\"f_ControlIndent\">On your Windows toolbar, click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Start » Run...<\/span><span class=\"f_ControlIndent\"> and then type &quot;<\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; font-weight: bold; color: #010100;\">mmc \/a<\/span><span class=\"f_ControlIndent\">&quot; into the text box.<\/span><\/td><\/tr><\/table><\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 1.0000rem 1.5625rem;\"><table style=\"border:none;border-spacing:0;padding:0;line-height: normal;\"><tr style=\"vertical-align:baseline\"><td style=\"border:none;padding:0;width:1.4375rem\"><span class=\"f_ControlIndent\">2.<\/span><\/td><td style=\"border:none;padding:0\"><span class=\"f_ControlIndent\">Click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">OK<\/span><span class=\"f_ControlIndent\">.<\/span><\/td><\/tr><\/table><\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 1.0000rem 1.5625rem;\"><table style=\"border:none;border-spacing:0;padding:0;line-height: normal;\"><tr style=\"vertical-align:baseline\"><td style=\"border:none;padding:0;width:1.4375rem\"><span class=\"f_ControlIndent\">3.<\/span><\/td><td style=\"border:none;padding:0\"><span class=\"f_ControlIndent\">In the Microsoft Management Console, click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">File » Add\/Remove Snap-in...<\/span><span class=\"f_MenuPath\"> on the menu bar <\/span><span class=\"f_ControlIndent\">(or press <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Ctrl+M<\/span><span class=\"f_ControlIndent\"> on your keyboard).<\/span><\/td><\/tr><\/table><\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 1.0000rem 1.5625rem;\"><table style=\"border:none;border-spacing:0;padding:0;line-height: normal;\"><tr style=\"vertical-align:baseline\"><td style=\"border:none;padding:0;width:1.4375rem\"><span class=\"f_ControlIndent\">4.<\/span><\/td><td style=\"border:none;padding:0\"><span class=\"f_ControlIndent\">On the Standalone tab, click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Add...<\/span><\/td><\/tr><\/table><\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 1.0000rem 1.5625rem;\"><table style=\"border:none;border-spacing:0;padding:0;line-height: normal;\"><tr style=\"vertical-align:baseline\"><td style=\"border:none;padding:0;width:1.4375rem\"><span class=\"f_ControlIndent\">5.<\/span><\/td><td style=\"border:none;padding:0\"><span class=\"f_ControlIndent\">On the <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Add Standalone Snap-in<\/span><span class=\"f_ControlIndent\"> dialog, click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Certificates<\/span><span class=\"f_ControlIndent\">, and then click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Add<\/span><span class=\"f_ControlIndent\">.<\/span><\/td><\/tr><\/table><\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 1.0000rem 1.5625rem;\"><table style=\"border:none;border-spacing:0;padding:0;line-height: normal;\"><tr style=\"vertical-align:baseline\"><td style=\"border:none;padding:0;width:1.4375rem\"><span class=\"f_ControlIndent\">6.<\/span><\/td><td style=\"border:none;padding:0\"><span class=\"f_ControlIndent\">On the <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Certificates snap-in<\/span><span class=\"f_ControlIndent\"> dialog, choose <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Computer account<\/span><span class=\"f_ControlIndent\">, and then click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Next<\/span><span class=\"f_ControlIndent\">.<\/span><\/td><\/tr><\/table><\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 1.0000rem 1.5625rem;\"><table style=\"border:none;border-spacing:0;padding:0;line-height: normal;\"><tr style=\"vertical-align:baseline\"><td style=\"border:none;padding:0;width:1.4375rem\"><span class=\"f_ControlIndent\">7.<\/span><\/td><td style=\"border:none;padding:0\"><span class=\"f_ControlIndent\">On the <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Select Computer<\/span><span class=\"f_ControlIndent\"> dialog, choose <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Local computer<\/span><span class=\"f_ControlIndent\">, and then click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Finish<\/span><span class=\"f_ControlIndent\">.<\/span><\/td><\/tr><\/table><\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 1.0000rem 1.5625rem;\"><table style=\"border:none;border-spacing:0;padding:0;line-height: normal;\"><tr style=\"vertical-align:baseline\"><td style=\"border:none;padding:0;width:1.4375rem\"><span class=\"f_ControlIndent\">8.<\/span><\/td><td style=\"border:none;padding:0\"><span class=\"f_ControlIndent\">Click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Close<\/span><span class=\"f_ControlIndent\">, and click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">OK<\/span><span class=\"f_ControlIndent\">.<\/span><\/td><\/tr><\/table><\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 1.0000rem 1.5625rem;\"><table style=\"border:none;border-spacing:0;padding:0;line-height: normal;\"><tr style=\"vertical-align:baseline\"><td style=\"border:none;padding:0;width:1.4375rem\"><span class=\"f_ControlIndent\">9.<\/span><\/td><td style=\"border:none;padding:0\"><span class=\"f_ControlIndent\">Under <\/span><span class=\"f_ControlIndent\" style=\"font-style: italic;\">Certificates (Local Computer)<\/span><span class=\"f_ControlIndent\"> in the left pane, if the certificate that you are importing is self-signed, click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Trusted Root Certification Authorities<\/span><span class=\"f_ControlIndent\"> and then <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Certificates<\/span><span class=\"f_ControlIndent\">. &nbsp;If it is not self-signed then click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Personal<\/span><span class=\"f_ControlIndent\">.<\/span><\/td><\/tr><\/table><\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 1.0000rem 1.5625rem;\"><table style=\"border:none;border-spacing:0;padding:0;line-height: normal;\"><tr style=\"vertical-align:baseline\"><td style=\"border:none;padding:0;width:1.4375rem\"><span class=\"f_ControlIndent\">10.<\/span><\/td><td style=\"border:none;padding:0\"><span class=\"f_ControlIndent\">On the menu bar, click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Action » All Tasks » Import...<\/span><span class=\"f_ControlIndent\">, and click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Next<\/span><span class=\"f_ControlIndent\">.<\/span><\/td><\/tr><\/table><\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 1.0000rem 1.5625rem;\"><table style=\"border:none;border-spacing:0;padding:0;line-height: normal;\"><tr style=\"vertical-align:baseline\"><td style=\"border:none;padding:0;width:1.4375rem\"><span class=\"f_ControlIndent\">11.<\/span><\/td><td style=\"border:none;padding:0\"><span class=\"f_ControlIndent\">Enter the file path to the certificate that you wish to import (using the Browse button if necessary), and click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Next<\/span><span class=\"f_ControlIndent\">.<\/span><\/td><\/tr><\/table><\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 1.0000rem 1.5625rem;\"><table style=\"border:none;border-spacing:0;padding:0;line-height: normal;\"><tr style=\"vertical-align:baseline\"><td style=\"border:none;padding:0;width:1.4375rem\"><span class=\"f_ControlIndent\">12.<\/span><\/td><td style=\"border:none;padding:0\"><span class=\"f_ControlIndent\">Click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Next<\/span><span class=\"f_ControlIndent\">, and click <\/span><span class=\"f_MenuPath\" style=\"font-weight: bold;\">Finish<\/span><span class=\"f_ControlIndent\">.<\/span><\/td><\/tr><\/table><\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">MDaemon will only display certificates that have private keys using the Personal Information Exchange format (PKCS #12). If your imported certificate does not appear in the list then you may need to import a <\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace;\">*.PEM<\/span><span class=\"f_Notes\"> file, which contains both a certificate key and private key. Importing this file using the same process outlined above will convert it to the PKCS #12 format.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_BodyText\"><\/p>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><span class=\"f_Heading3\">Using Let\'s Encrypt to Manage Your Certificate<\/span><\/h3>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Let\'s Encrypt is a Certificate Authority (CA) that provides free certificates via an automated process designed to eliminate the currently complex process of manual creation, validation, signing, installation, and renewal of certificates for secure websites.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">To support using Let\'s Encrypt\'s automated process to manage a certificate, the <a href=\"ssl_lets-encrypt.html\" class=\"topiclink\">Let\'s Encrypt<\/a> screen is provided to help you easily configure and run the PowerShell script included in the &quot;<\/span><span class=\"f_PlainText\">MDaemon\\LetsEncrypt<\/span><span class=\"f_BodyText\">&quot; folder. Running the script will set up everything for Let\'s Encrypt, including putting the necessary files in the Webmail HTTP folder to complete the http-01 challenge. It uses the <a href=\"domain-manager_host_name_ip.html\" class=\"topiclink\">SMTP host name<\/a> of the <a href=\"domain-manager.html\" class=\"topiclink\">default domain<\/a> as the domain for the certificate, includes any <\/span><span class=\"f_BodyText\" style=\"font-style: italic;\">Alternate host names<\/span><span class=\"f_BodyText\"> you have specified, retrieves the certificate, imports it into Windows, and configures MDaemon to use the certificate for MDaemon, Webmail, and Remote Administration. Further, the script creates a log file in the &quot;<\/span><span class=\"f_PlainText\">MDaemon\\Logs\\<\/span><span class=\"f_BodyText\">&quot; folder, called <\/span><span class=\"f_PlainText\">LetsEncrypt.log<\/span><span class=\"f_BodyText\">. This log file is removed and recreated each time the script runs, and it includes the starting date and time of the script. Also, notification emails will be sent when errors occur if you specify an <\/span><span class=\"f_BodyText\" style=\"font-style: italic;\">Admin email for notifications<\/span><span class=\"f_BodyText\">. See the <a href=\"ssl_lets-encrypt.html\" class=\"topiclink\">Let\'s Encrypt<\/a> topic for more information.<\/span><\/p>\n\r<p class=\"p_SeeAlso\" style=\"page-break-after: avoid; border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_SeeAlso\">See:<\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"ssl__certificates.html\" class=\"topiclink\">SSL &amp; TLS<\/a><\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r"
})
