Fortimail with SSL and SNI

[nicolasross]

We are planing on installer fortimail (vm) to protect our mail server. We avec more than 100 domains on our server. Curently, when a users connects to sendmail via our smtp, they use mostly mail.maindomain.com as smtp host, with ssl and authentification.

Some users are configured differently, so they use mail.theirdomain.com as smtp host, still in SSL with auth. That host points to the same IP of mail.maindomain.com, and our mail server uses SNI to offer the right certificat to the client.

If we implement fortimail, it's outside hostname will probably be let's say fortimail.maindomain.com, and an ssl cert for that name will be made. I will point client's domains MX to that name. But if I want to prevent anyone to send mail directly to the mailserver, I must either tell all users to modify their config to use fortimail.maindomain.com, which I would like to avoid, or point mail.theirdomain.com to the fortimail server.

So far, I was not able to specify multiple certs to be used by the fortimail, and was only able to select the certificate to be used by setting the default one to fortimail.maindomain.com

Is there a way to import multiple certificate and make them availaible with SNI ?

[emnoc]

Can you not use a SLB in front of the  FML appliance? Here you can load the server-cert and handle the SNI

Ken

[nicolasross]

SLB ? SSL Load balancer ?

I was trying to avoid another vm/service in front of the Fortimail...

[emnoc]

Could you buy a  SAN-cert and consolidate all ( sitesnames )  into one certificate. ( you will need to investigate what  CAs offers 100+ altNames  ). Be advise, you might want to test a dummy  selfSign SAN certificate with the FML to ensure that would work.

Since a MX record is what  drive  the traffic,  why can't you just use the one single  name for  SMTP gateway? When I used to host mail we have a MX01.<myhostingcompany>.com for all of  the protect-domains and enable each domain that we protected.

We didn't apply a unique mailgateway hostname, the protect-domain is what drive what we protected

Now if you are doing servermode-model and you want a unique domainname, that would be very  different and difficult.

e.g

https://yourmwebmail.customer1domain.com

https://yourmwebmail.customer2domain.com

https://yourmwebmail.customer3domain.com

Again a SANs  certificate might come in handy.

I believe IronPoint has multiple SSL/TLS listener support for a few years now. Here you could bind a TLS certificate to a UNIQUE listener ( not SNI ).

Why I suggested a SLB, they do SNI with ease and will fill your  requirement and provide some type of HA if you wanted just one single MX entry. Again in my  past mailhosting experinces"  We did dns round-robin  and offer mail in two region, in each region we have a SLB in front of the mail  gateway. This was more of act-act mail-gateway if you wanted to look at it that way."

Ken

[nicolasross]

Thanks for the input, we'll see when we begin migrating client domains to fortimail. Most users are supposed to use mail.maindomain.com as smtp endpoint.

We use Let's Encrypt as our CA for our mailserver, and it permits up to 100 SAN per cert.

A couple of clients are using their own domain, and are on separate ips, so I beleive I can manage with the max of 100 SAN per cert, creating a couple of configs.

Another questions comes to mind. After directing client's mx to mx01(or fortimail, or whatver).maindomain.com, where that points to fortimail, do you let the mailserver still availaible to the internet at mail.mainddomain.com ? I might not want to point this the the fortimail so that pop and imap passes directly to the mailserver.

[emnoc]

Yes let's encrypt would be a short term fix, outside of the  continous renewal of the certificate-sign-requests.

We use Let's Encrypt as our CA for our mailserver, and it permits up to 100 SAN per cert.

You could use it and just revoke and rebuild a new    CERT-REQUEST if your finding your  adding   new altNames. If you do go this route and  add "wildcards" in the  AltNames, please update us if this does work or hit me with a PM.

Wildcards are suppose to be available now or soon, so key a eye out on it. You might be that guinea-pig that could give us valuable  input and feedback ;)

[nicolasross]

emnoc wrote:

Yes let's encrypt would be a short term fix, outside of the  continous renewal of the certificate-sign-requests.

There's an API for fortimail that can be used to upload certs (as fortiweb for that matter). I will probably develop something and maybe release it on github...

[emnoc]

That's good news, I didn't know ACME client support exists in  a commercial FML appliance

[nicolasross]

emnoc wrote:

That's good news, I didn't know ACME client support exists in  a commercial FML appliance

I don't believe it exists. The FML API can be used to make configuration changes, and to update/replace certificate (AFAIK). So a shell script can be used as a hook-script to Dehydrated, the bash client I use to interface with LE via ACME on my servers.

[emnoc]

Okay so your  using the API just to  push the new cert/key into the FML?