hmLoadTopic({
hmKeywords:"Certificates,Email SSL,MDaemon,Secure Sockets Layer protocol,SSL & Certificates,SSL & TLS,SSL & TLS MDaemon,STARTTLS,STLS,TLS",
hmTitle:"MDaemon",
hmDescription:"Enable SSL, STARTTLS, and STLS Click this check box to activate support for the SSL\/TLS protocol and the STARTTLS and STLS extensions. Then, choose the certificate that you want",
hmPrevLink:"ssl__certificates.html",
hmNextLink:"ssl_worldclient.html",
hmParentLink:"ssl__certificates.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a> &gt; Security Manager &gt; <a href=\"ssl__certificates.html\">SSL &amp; TLS<\/a>",
hmTitlePath:"Security Menu > Security Manager > SSL & TLS > MDaemon",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">MDaemon<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:32.7500rem;height:27.1875rem;border:none\" src=\".\/images\/ssl-tls_mdaemon.png\"\/><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Enable SSL, STARTTLS, and STLS<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this check box to activate support for the SSL\/TLS protocol and the STARTTLS and STLS extensions. Then, choose the certificate that you want to use from the list below.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Enable the dedicated SSL ports for SMTP, IMAP, POP3 servers<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you want to make available the dedicated SSL ports specified on <a href=\"default-domain-and-servers_ports.html\" class=\"topiclink\">Ports<\/a> under Default Domains &amp; Servers. This will not affect clients using STARTTLS and STLS on the default mail ports — it merely provides an additional level of support for SSL.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">SMTP server sends mail using STARTTLS when possible<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this option if you want MDaemon to attempt to use the STARTTLS extension for every SMTP message it sends. If a server to which MDaemon is connecting doesn\'t support STARTTLS then the message will be delivered normally without using SSL. Use the <a href=\"ssl_white-list.html\" class=\"topiclink\">No STARTTLS List<\/a> if you wish to prevent the use of STARTTLS for certain domains.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">SMTP server requires STARTTLS on MSA port<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you wish to require STARTTLS for connections to the server made on the <a href=\"default-domain-and-servers_ports.html\" class=\"topiclink\">MSA port<\/a>.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">DomainPOP\/MultiPOP servers use STLS whenever possible<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Check this box if you want the DomainPOP and MultiPOP servers to use the STLS extension whenever possible.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Automatically detect and activate newer certifications<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">When this option is enabled, MDaemon will check at startup and during its daily maintenance for newer versions of each active certificate for MDaemon, Webmail, and Remote Administration. If another certificate on the system expires later, is for the same hostname, and includes all alternative hostnames, MDaemon will automatically switch to it and restart the affected servers. This option is enabled by default.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Select certificate to use for SSL<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">This box displays your SSL certificates. Check the box next to any certificates you wish to be active. Click the star next to the one that you wish to set as the default certificate. MDaemon supports the Server Name Indication (SNI) extension to the TLS protocol, which allows a different certificate to be used for each of your server\'s host names. MDaemon will look at the active certificates and choose the one that has the requested host name in its Subject Alternative Names field (you can specify the alternate names when creating the certificate). If the client does not request a host name, or if no matching certificate is found, then the default certificate is used. Double-click a certificate to open it in Windows\' Certificate dialog for review (only available in the application interface, not in the browser-based remote administration).<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Delete<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Select a certificate in the list and then click this button to delete it. A confirmation box will open and ask you if you are sure that you want to delete the certificate.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Create Certificate<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this button to open the Create SSL Certificate dialog.<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><img style=\"margin:0;width:27.7500rem;height:19.5000rem;border:none\" src=\".\/images\/worldclient_ssl-https_create.png\"\/><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Certificate Details<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Host name<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">When creating a certificate, enter the host name to which your users will connect (for example, &quot;mail.example.com&quot;).<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Organization\/company name<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enter the organization or company that &quot;owns&quot; the certificate here.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Alternative host names (separate multiple entries with a comma)<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">If there are alternative host names to which users may be connecting and you want this certificate to apply to those names as well, then enter those domain names here separated by commas. Wildcards are permitted, so &quot;<\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">*.example.com<\/span><span class=\"f_ControlIndent\">&quot; would apply to all sub domains of <\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">example.com<\/span><span class=\"f_ControlIndent\"> (for example, &quot;<\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">wc.example.com<\/span><span class=\"f_ControlIndent\">&quot;, &quot; <\/span><span style=\"font-size: 1.10rem; font-family: \'Courier New\',Courier,monospace; color: #010100;\">mail.example.com<\/span><span class=\"f_ControlIndent\">&quot;, and so on).<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/lightbulb_on_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">MDaemon supports the Server Name Indication (SNI) extension to the TLS protocol, which allows a different certificate to be used for each of your server\'s host names. MDaemon will look at the active certificates and choose the one that has the requested host name in its Subject Alternative Names field. If the client does not request a host name, or if no matching certificate is found, then the default certificate is used.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Encryption key length<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Choose the desired bit-length of the encryption key for this certificate. The longer the encryption key the more secure the transferred data will be. Note, however, that not all applications support key lengths longer than 512.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Hash algorithm<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Choose the hash algorithm that you wish to use: SHA1 or SHA2. The default setting is SHA2.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Country\/region<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Choose the country or region in which your server resides.<\/span><\/p>\n\r<p class=\"p_DialogSectionHeading\" style=\"page-break-after: avoid;\"><span class=\"f_DialogSectionHeading\">Restart servers<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Click to restart the SMTP\/IMAP\/POP servers. The servers must be restarted when a certificate changes.<\/span><\/p>\n\r<p class=\"p_SeeAlso\" style=\"page-break-after: avoid; border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_SeeAlso\">See:<\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"ssl__certificates.html\" class=\"topiclink\">SSL &amp; TLS<\/a><\/span><\/p>\n\r<p class=\"p_SeeAlsoLinks\" style=\"page-break-after: avoid;\"><span class=\"f_SeeAlsoLinks\"><a href=\"ssl_creating_and_using_ssl_certifi.html\" class=\"topiclink\">Creating and Using SSL Certificates<\/a><\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">&nbsp;<\/span><\/p>\n\r"
})
