[JAMES-4024] Add support for SNI (separate certificate per domain)

• Type: New Feature
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.8.1
• Component/s: protocols
• Assignee: Unassigned
• Reporter: Amichai Rothman
• Created: 31/Mar/24 05:55
• Updated: 01/Apr/24 19:38

Description

Currently it is only possible to configure one global certificate for all TLS communication of the entire server. However, many SMTP servers nowadays can be configured to validate that a certificate matches the (mx record) domain name when connecting to another SMTP server, and thus many SMTP servers also support SNI so they can serve up the proper certificate when receiving mail messages for multiple domains.

James should also support SNI so it can work properly with secure configurations of all other SMTP servers, i.e. allow adding a separate certificate per supported domain(s), and support SNI to select the correct one per TLS connection. The existing global certificate can remain as fallback and to avoid breaking existing configurations.