Disable SNI for Dovecot SSL configuration

Virtualmin
1

Hello,

Is there any method to totally disable SNI configuration for Dovecot on Virtualmin?
The reason for that is Virtualmin modify from time to time dovecot.conf and replace local_name for default domain (used for mail client configuration), from:

local_name mail.mydomain.tld {
  ssl_cert = </home/mydomain/domains/mail.mydomain.tld/ssl.cert
  ssl_key = </home/mydomain/domains/mail.mydomain.tld/ssl.key
  ssl_ca = </home/mydomain/domains/mail.mydomain.tld/ssl.ca
}

to:

local_name mail.mydomain.tld {
  ssl_cert = </home/mydomain/ssl.cert
  ssl_key = </home/mydomain/ssl.key
  ssl_ca = </home/mydomain/domains/mail.mydomain.tld/ssl.ca
}

CentOS Linux release 7.7.1908 (Core)
Webmin version 1.941
Virtualmin version 6.08

Thank you for your time.

Best regards,
Catalin.

2

HI,

I don’t think it’s possible. If Dovecot is version 2 and above, then it’s SNI capable, and in case SSL is enabled in Dovecot (set to yes or require), then it automatically updates domain’s certs.

The workaround for you could be is to set proper path, of where certs should searched.

image
image1999×515 114 KB

3

Ok, I understand.
I have the same settings in Virtualmin Configuration.

But maybe should be better for users that Virtualmin consider ~ (home path) to domain and subdomain (subserver) to be relative, for example:
/home/mydomain/ssl.cert - for mydomain.tld
/home/mydomain/domains/mail.mydomain.tld/ssl.cert - for mail.mydomain.tld
I don’t really want that mydomain.tld and mail.mydomain.tld share the same ssl certificate.

Anyway, it’s strange that Virtualmin modifies sometimes automatically dovecot.conf (even if it’s already configured SNI for that domain). And modifies only ssl.cert and ssl.key paths, and not ssl.ca :-/

Thank you,
Catalin

4

Do you perhaps need to have a look at this option, in Virtualmin Configuration.

image
image1183×658 122 KB

5

Could be. I’ve disabled that option.
Now I’ll wait to see if Virtualmin rewrites correctly local_names’s definition in dovecot.conf (I don’t know how to force that).

Thank you for your help.

Best regards,
Catalin

6

Upcoming Virtualmin 6.09 has a fix in this regard, by the way.