“If you’ve been given the thumbs up about the certificate, but want to cover both “mail.” and “www.” you’ll actually need two individual certificates with two IP addresses.”
If I have an additional IP4 address that will be dedicated to newclient.com why do I need 2 IP addresses. Surely I can just buy 2 SSL certs (www.newclient.com and mail.newclient.com both would cover newclient.com) and use them with apache and postfix/dovecot respectively ?
After adding the new IP4 address as a new virtual interface (eth0:1) and restarting networking in webmin. The server should be listening on all addresses.
I am unsure where to set the new IP address for newclient.com. Do I use the [Addresses and Networking] [Change IP Address] menu in Virtualmin to change the IP4 address for the newclient.com virtual server? That option seems to change the IP address correctly in the Virtual Server and the DNS addresses.
Apache/Postifx/Dovecot are set to use all available IP4 addresses so should be listening. If I setup the www.newclient.com SSL cert in the Virtual Server that would seem to set the correct SSL cert in the apache virtual server.
However do I then need to hack the postfix/dovecot config files to use the correct per ip ssl cert for the mail.newclient.com SSL certificate? I cannot see any other way to get the mail servers to use the mail.newclient.com SSL certificate for mail connections to the newclient.com IP4 address.
Such as below to bind each certificate to its corresponding IP:
1.1.1.1- unix - n n - - smtp -o smtp_bind_address=1.1.1.1 -o smtp_bind_address6= -o smtp_address_preference=ipv4
2.2.2.2- unix - n n - - smtp -o smtp_bind_address=2.2.2.2 -o smtp_bind_address6= -o smtp_address_preference=ipv4
#smtp inet n - n - - smtpd
#smtps inet n - n - - smtpd -o smtpd_tls_wrappermode=yes
#submission inet n - n - - smtpd -o smtpd_enforce_tls=yes -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_restrictions=
1.1.1.1:smtp inet n - n - - smtpd -o smtpd_tls_cert_file=/etc/postfix/cert1.pem -o smtpd_tls_key_file=/etc/postfix/cert1.pem
1.1.1.1:smtps inet n - n - - smtpd -o smtpd_tls_wrappermode=yes -o smtpd_tls_cert_file=/etc/postfix/cert1.pem -o smtpd_tls_key_file=/etc/postfix/cert1.pem
1.1.1.1:submission inet n - n - - smtpd -o smtpd_enforce_tls=yes -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_restrictions= -o smtpd_tls_cert_file=/etc/postfix/cert1.pem -o smtpd_tls_key_file=/etc/postfix/cert1.pem
2.2.2.2:smtp inet n - n - - smtpd -o smtpd_tls_cert_file=/etc/postfix/cert2.pem -o smtpd_tls_key_file=/etc/postfix/cert2.pem
2.2.2.2:smtps inet n - n - - smtpd -o smtpd_tls_wrappermode=yes -o smtpd_tls_cert_file=/etc/postfix/cert2.pem -o smtpd_tls_key_file=/etc/postfix/cert2.pem
2.2.2.2:submission inet n - n - - smtpd -o smtpd_enforce_tls=yes -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject -o smtpd_sender_restrictions= -o smtpd_tls_cert_file=/etc/postfix/cert2.pem -o smtpd_tls_key_file=/etc/postfix/cert2.pem
And for Dovecot:
If you have multiple IPs available, this method is guaranteed to work with all clients.
local 1.1.1.1 { # instead of IP you can also use hostname, which will be resolved
protocol imap {
ssl_cert = </etc/ssl/dovecot/imap-01.example.com.cert.pem
ssl_key = </etc/ssl/dovecot/imap-01.example.com.key.pem
}
protocol pop3 {
ssl_cert = </etc/ssl/dovecot/pop-01.example.com.cert.pem
ssl_key = </etc/ssl/dovecot/pop-01.example.com.key.pem
}
}
local 2.2.2.2 {
protocol imap {
ssl_cert = </etc/ssl/dovecot/imap-02.example.com.cert.pem
ssl_key = </etc/ssl/dovecot/imap-02.example.com.key.pem
}
protocol pop3 {
ssl_cert = </etc/ssl/dovecot/pop-02.example.com.cert.pem
ssl_key = </etc/ssl/dovecot/pop-02.example.com.key.pem
}
}
Concerned about having to hack configs, when this has got to be a fairly standard use case for a virtual hosting platform!
Many thanks for bearing with me as I navigate these muddy waters 
Any further help appreciated.
Cheers
Spart