Nginx – use the same SSL certificate for smtp, imap, pop3 and http

couriereximnginxsslssl-certificate

So far I'm using self-signed certificates, but decided to at least consider getting the "real" one.

So far I noticed that internal formats of the certificated are a bit different, that is:

  • http (nginx) certificate has only CERTIFICATE part (with base64 encoded content) and KEY with also only base64 content
  • smtp (exim) crt file contains certificate textual information (issuer, subject, algorithm, dates, and so on), plus CERTIFICATE block with base64 data, while the .key file for exim contains only base64 encoded key
  • imap/pop3 (courier) .pem file contains key (base64), certificate info (textual), and certificate itself (base64).

Can I get any "web" certificate from thawte or some company like this, and from this (and key file) generate all formats that I need for nginx, exim4 and courier, or do I need to get separate certificates, or is it something else entirely?

Best Answer

The short answer is that yes a single certificate can be used for all those services.

The key and certificate can be stored in many formates, and using the openssl tool you can convert your key and certificate to other formats.

The real barrier is can you get a certificate that is valid for all the names that you wish to use. For your web you might want to use www.example.com, and for your mail you might want to use mail.example.com. You can get a wildcard or SAN certificate that will cover lots of names, but these cost more. It may be cheaper to get a couple individual certificates. The prices for different certs are different, so take some time and work out which will be cheaper in your case.

Related Topic