VPOP3 Enterprise supports SSL certificates for encrypted sessions.

The basic mechanism to create an SSL certificate is that you have to generate a CSR (Certificate Signing Request) then send that to a CA (Certificate Authority) who will sign your certificate and give you the certificate back.

When you generate the CSR, you will also generate a Private Key file. This isn't sent anywhere, but is needed, so keep it safe. For VPOP3's use the private key file must not have a password.

VPOP3 requires certificates & private keys to be in .PEM (Privacy Enhanced Mail) format which is a common format used by most people other than Microsoft. There are ways to convert .P12 .PFX and .CER files to PEM format, but those are outside the scope of this article.

There are many ways to generate a CSR, so if you have a favourite program to do that, which can produce the files in .PEM format, feel free to use that. Otherwise, you can use the GenCert program from our website.

Once you have generated the CSR you need to send it to a Certificate Authority. This is typically someone like GeoTrust, Verisign etc. They will charge you (typically somewhere betwee £80 to £800 per year) to sign the certificate, and you will need to prove your identity to the CA by some means. The level of this proof usually depends on the type of certificate. Some will just need you to prove you own that domain (eg by acknowledging that you receive an email to the domain), others will need you to send in copies of documentation.

You can also set up as your own CA. The GenCert program above will let you do this, other programs are available to do this. This is free, but when you access a service using a certificate signed by your own CA, the email client or web browser may warn you that the certificate is not validated properly, and you will need to accept the warning. The data will still be encrypted just as with a £800 Verisign certificate, but the warning may not be desirable, and the server's identity will not be verified. It can be useful to use this method for testing, and then have a recognised CA sign the certificate when you are ready for wider deployment.

Note that the 'Private Key' file MUST NOT require a password to access it.

You can self-sign certificates or get them from a Certificate Authority.

We can obtain basic GeoTrust certificates for you for £29.95 (+VAT if applicable) per year. Please contact us for details as we need extra information to produce the certificate for you. We can also obtain more complex certificates if you require, but for most cases they aren't necessary.

Please note that if you get a certificate from another source there is a limited amount we can do if there is a problem since you may have requested the wrong type of certificate or have the wrong settings. If we supply a certificate it will work with VPOP3 Enterprise, if someone else supplies it we cannot guarantee that.

A lot of certificates nowadays need to have an 'Intermediate Certificate' with them. In PEM files you simply concatenate them, so the certificate file (vpop3sslc.pem) will look like:

-----BEGIN CERTIFICATE-----
<site certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<intermediate certificate>
-----END CERTIFICATE-----

If the issuing certificate authority requires an intermediate certificate you will have to get that certificate's details from them, we cannot supply that information (unless you purchased the certificate via ourselves).