We are planing on installer fortimail (vm) to protect our mail server. We avec more than 100 domains on our server. Curently, when a users connects to sendmail via our smtp, they use mostly mail.maindomain.com as smtp host, with ssl and authentification.
Some users are configured differently, so they use mail.theirdomain.com as smtp host, still in SSL with auth. That host points to the same IP of mail.maindomain.com, and our mail server uses SNI to offer the right certificat to the client.
If we implement fortimail, it's outside hostname will probably be let's say fortimail.maindomain.com, and an ssl cert for that name will be made. I will point client's domains MX to that name. But if I want to prevent anyone to send mail directly to the mailserver, I must either tell all users to modify their config to use fortimail.maindomain.com, which I would like to avoid, or point mail.theirdomain.com to the fortimail server.
So far, I was not able to specify multiple certs to be used by the fortimail, and was only able to select the certificate to be used by setting the default one to fortimail.maindomain.com
Is there a way to import multiple certificate and make them availaible with SNI ?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Can you not use a SLB in front of the FML appliance? Here you can load the server-cert and handle the SNI
Ken
PCNSE
NSE
StrongSwan
SLB ? SSL Load balancer ?
I was trying to avoid another vm/service in front of the Fortimail...
Could you buy a SAN-cert and consolidate all ( sitesnames ) into one certificate. ( you will need to investigate what CAs offers 100+ altNames ). Be advise, you might want to test a dummy selfSign SAN certificate with the FML to ensure that would work.
Since a MX record is what drive the traffic, why can't you just use the one single name for SMTP gateway? When I used to host mail we have a MX01.<myhostingcompany>.com for all of the protect-domains and enable each domain that we protected.
We didn't apply a unique mailgateway hostname, the protect-domain is what drive what we protected
Now if you are doing servermode-model and you want a unique domainname, that would be very different and difficult.
e.g
https://yourmwebmail.customer1domain.com
https://yourmwebmail.customer2domain.com
https://yourmwebmail.customer3domain.com
Again a SANs certificate might come in handy.
I believe IronPoint has multiple SSL/TLS listener support for a few years now. Here you could bind a TLS certificate to a UNIQUE listener ( not SNI ).
Why I suggested a SLB, they do SNI with ease and will fill your requirement and provide some type of HA if you wanted just one single MX entry. Again in my past mailhosting experinces" We did dns round-robin and offer mail in two region, in each region we have a SLB in front of the mail gateway. This was more of act-act mail-gateway if you wanted to look at it that way."
Ken
PCNSE
NSE
StrongSwan
Thanks for the input, we'll see when we begin migrating client domains to fortimail. Most users are supposed to use mail.maindomain.com as smtp endpoint.
We use Let's Encrypt as our CA for our mailserver, and it permits up to 100 SAN per cert.
A couple of clients are using their own domain, and are on separate ips, so I beleive I can manage with the max of 100 SAN per cert, creating a couple of configs.
Another questions comes to mind. After directing client's mx to mx01(or fortimail, or whatver).maindomain.com, where that points to fortimail, do you let the mailserver still availaible to the internet at mail.mainddomain.com ? I might not want to point this the the fortimail so that pop and imap passes directly to the mailserver.
Yes let's encrypt would be a short term fix, outside of the continous renewal of the certificate-sign-requests.
We use Let's Encrypt as our CA for our mailserver, and it permits up to 100 SAN per cert.
You could use it and just revoke and rebuild a new CERT-REQUEST if your finding your adding new altNames. If you do go this route and add "wildcards" in the AltNames, please update us if this does work or hit me with a PM.
Wildcards are suppose to be available now or soon, so key a eye out on it. You might be that guinea-pig that could give us valuable input and feedback ;)
PCNSE
NSE
StrongSwan
emnoc wrote:There's an API for fortimail that can be used to upload certs (as fortiweb for that matter). I will probably develop something and maybe release it on github...Yes let's encrypt would be a short term fix, outside of the continous renewal of the certificate-sign-requests.
That's good news, I didn't know ACME client support exists in a commercial FML appliance
PCNSE
NSE
StrongSwan
emnoc wrote:That's good news, I didn't know ACME client support exists in a commercial FML appliance
I don't believe it exists. The FML API can be used to make configuration changes, and to update/replace certificate (AFAIK). So a shell script can be used as a hook-script to Dehydrated, the bash client I use to interface with LE via ACME on my servers.
Okay so your using the API just to push the new cert/key into the FML?
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1702 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.