Chapter 3 Mail Service Advanced Conguration 67
Securing Mail Service with SSL
Secure Sockets Layer (SSL) connections ensure that the data sent between your mail
server and your users’ mail clients is encrypted. This allows secure and condential
transport of mail messages across a local network.
SSL transport doesn’t provide secure authentication. It only provides secure transfer
from your mail server to your clients. For secure authentication information, see
“Choosing Authentication for Mail Service” on page 64.
For incoming mail, Mail service supports secure mail connections with mail client
software that requests them. If a mail client requests an SSL connection, Mail service
can comply if that option is enabled.
Mail service still provides non-SSL (unencrypted) connections to clients that don’t
request SSL. The conguration of each mail client determines whether it connects with
SSL or not.
For outgoing mail, Mail service supports secure mail connections between SMTP
servers. If an SMTP server requests an SSL connection, Mail service can comply if that
option is enabled. Mail service can still allow non-SSL (unencrypted) connections to
mail servers that don’t request SSL.
Conguring SSL for mail transport
Mail service requires some conguration to provide SSL connections automatically.
The basic steps are as follows:
1 Obtain a security certicate.
This can be done in the following ways:
Get a certicate from an external Certicate Authority. See “ Â Using an SSL Certicate
from an External Certicate Authority” on page 69.
Create a self-signed certicate in Server Admin’s Certicate Manager. Â
Locate an existing certicate from a previous installation of Mac OS X Server v10.3 Â
or later.
2 Import the certicate into Server Admin’s Certicate Manager.
You can use Certicate Manager to drag and drop certicate information or you can
provide Certicate Manager with the path to an existing installed certicate. You
can also import certicates from the command line as outlined in “Accessing Server
Certicates from the Command Line” on page 71.
3 Congure the service to use the certicate.
For instructions for allowing or requiring SSL transport, see the following sections:
“ Â Conguring SSL Transport for SMTP Connections” on page 68
“ Â Conguring SSL Transport for IMAP and POP Connections” on page 68
