VPOP3 Enterprise supports SSL certificates for encrypted sessions.

The basic mechanism to create an SSL certificate is that you have to generate a CSR (Certificate Signing Request) then send that to a CA (Certificate Authority) who will sign your certificate and give you the certificate back.

When you generate the CSR, you will also generate a Private Key file. This isn't sent anywhere, but is needed, so keep it safe. For VPOP3's use the private key file must not have a password.

VPOP3 requires certificates & private keys to be in .PEM (Privacy Enhanced Mail) format which is a common format used by most people other than Microsoft. There are ways to convert .P12 .PFX and .CER files to PEM format, but those are outside the scope of this article.

There are many ways to generate a CSR, so if you have a favourite program to do that, which can produce the files in .PEM format, feel free to use that. Otherwise, you can use OpenSSL - see below.

Once you have generated the CSR you need to send it to a Certificate Authority. This is typically someone like GeoTrust, Sectigo etc. They will charge you (typically somewhere betwee £50 to £400 per year) to sign the certificate, and you will need to prove your identity to the CA by some means. The level of this proof usually depends on the type of certificate. Some will just need you to prove you own that domain (eg by acknowledging that you receive an email to the domain), others will need you to send in copies of documentation.

You can also generate self-signed certificates. The Windows Server Certificate Server can do this for you, or you can use OpenSSL - see below. This is free, but when you access a service using a self-signed certificate , the email client or web browser may warn you that the certificate is not validated properly, and you will need to accept the warning. The data will still be encrypted just as with a £400 Sectigo certificate, but the warning may not be desirable, and the server's identity will not be verified. It can be useful to use this method for testing, and then have a recognised CA sign the certificate when you are ready for wider deployment.

Note that the 'Private Key' file MUST NOT require a password to access it.

You can self-sign certificates or get them from a Certificate Authority.

We can obtain basic GeoTrust certificates for you for £29.95 (+VAT if applicable) per year. Please contact us for details as we need extra information to produce the certificate for you. We can also obtain more complex certificates if you require, but for most cases they aren't necessary.

Please note that if you get a certificate from another source there is a limited amount we can do if there is a problem since you may have requested the wrong type of certificate or have the wrong settings. If we supply a certificate it will work with VPOP3 Enterprise, if someone else supplies it we cannot guarantee that.

A lot of certificates nowadays need to have an 'Intermediate Certificate' with them. In PEM files you simply concatenate them, so the certificate file (vpop3sslc.pem) will look like:

-----BEGIN CERTIFICATE-----
<site certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<intermediate certificate>
-----END CERTIFICATE-----

If the issuing certificate authority requires an intermediate certificate you will have to get that certificate's details from them, we cannot supply that information (unless you purchased the certificate via ourselves).

OpenSSL is free software to handle encryption, certificates, etc. It's very commonly used, so you will find a lot of documentation on the Internet about it.

For Windows, the best place to download it from is https://slproweb.com/products/Win32OpenSSL.html Download the 'Light' version, eg “Win64 OpenSSL v3.6.1 Light” (the version will change over time). It doesn't need to be installed on the VPOP3 computer.

If you are using Linux, then OpenSSL is usually installed as standard

OpenSSL has to be used from a command prompt. The following sections give examples of how to perform common tasks using OpenSSL

See the 'Using OpenSSL' section above for instructions on installation and usage

Then run:

openssl req -newkey rsa:2048 -nodes -keyout key.pem -out csr.pem

1. This will first display some 'garbage', which is the cryptographically secure random number generator operating
2. Then it will prompt for information about your organisation. Most of this may just be encoded in the certificate for someone accessing your server to be able to see. The Common Name is important though, as that has to match the DNS host name of the server, as the software accessing the server will verify that this is the same as the server name that it has connected to
   1. Country Name - use a two letter country code, eg GB (for United Kingdom), US (for USA), FR (for France) etc (See this Wikipedia article for a full list of countries and country codes)
   2. State or Province Name - eg “Yorkshire” or “New York”
   3. Locality Name - eg “London” or “Manchester”
   4. Organisation Name - eg ACME Inc.
   5. Organisational Unit Name - IT or Software
   6. Common Name - this is the DNS host name of your VPOP3 computer, eg mail.example.com
   7. Email Address - a contact email address (or blank)
3. Then it will ask for two extra bits of information which can be left blank: challenge password, and optional company name

This will generate two files:

• key.pem. This is the private key. Keep this file very safe. If that gets lost, then you will need to regenerate the CSR, and send the new one to the Certificate Authority. Do not give key.pem to anyone you do not trust, as it will allow them to spoof your server certificate. Note that the Certificate Authority do NOT need access to the private key.
• csr.pem. This is the certificate request. You will need to send this to the Certificate Authority for them to generate the certificate for you. It is a text file, so you will be able to open it in something like Notepad and copy/paste the contents if necessary

See the 'Using OpenSSL' section above for instructions on installation and usage

Then, run:

openssl req -x509 -newkey rsa:4096 -nodes -keyout key.pem -out cert.pem -sha256 -days 365

This will generate a private key and self-signed certificate with an expiry of 365 days

You will be prompted for organisation and certificate information as when generating a CSR as above.

It will produce two files key.pem and cert.pem which you can copy/paste into VPOP3's Server SSL Settings