Dovecot with virtual hosts and SSL - wrong certificate?

Question

I am trying to configure Dovecot with multiple vhosts using SSL.

I set my main domain (example.de) for my vhosts (example2.com and example3.co.uk). I am using local -option.

My problem:

When I connect to my server, it complains about the wrong host name (example3.co.uk) in my main and other domain for the certificate.

How can I make dovecot use the correct certificate for each host?

Here is my dovecot configuration:

listen = *
ssl = yes
protocols = imap pop3
disable_plaintext_auth = no
auth_mechanisms = plain login
mail_access_groups = vmail
default_login_user = vmail
first_valid_uid = 2222
first_valid_gid = 2222
#mail_location = maildir:~/Maildir
mail_location = maildir:/home/vmail/%d/%n

passdb {
    driver = passwd-file
    args = scheme=SHA1 /etc/dovecot/passwd
}
userdb {
    driver = static
    args = uid=2222 gid=2222 home=/home/vmail/%d/%n allow_all_users=yes
}
service auth {
    unix_listener auth-client {
        group = postfix
        mode = 0660
        user = root
    }
    user = root
}
service imap-login {
  process_min_avail = 1
  user = vmail
}

ssl_cert = </etc/pki/tls/certs/example.de.crt
ssl_key = </etc/pki/tls/private/example.de.key

local ohmygodpresents.com {
  ssl_cert = </etc/pki/tls/certs/example2.com.crt
  ssl_key = </etc/pki/tls/private/example2.com.key
}
local ohmygodpresents.co.uk {
  ssl_cert = </etc/pki/tls/certs/example3.co.uk.crt
  ssl_key = </etc/pki/tls/private/example3.co.uk.key
}

Answer 1

How can I make dovecot use the correct certificate for each host?

.

TLS 1.0 , Server Name Indication (SNI). Dovecot , , .

/ OpenSSL s_client. , "" :

openssl s_client -tls1 -starttls smtp -connect mail.example.com:587 -servername mail.example.com

Dovecot , example.com SSL/TLS. , STARTTLS , Dovecot , RCPT . RCPT , Dovecot / .

"" . SSLv3, SNI (SNI - TLS):

openssl s_client -ssl3 -starttls smtp -connect mail.example.com:587

"" . TLS 1.0, SNI:

openssl s_client -tls1 -starttls smtp -connect mail.example.com:587

// Wireshark. SNI ClientHello. , , , , SNI, . SSL/TLS - ( ). , Finished.

SSLv2/SSLv3 TLS, . SNI. Windows XP - TLS 1.0, SNI. , , .

- "-". , DNS-, . SAN DNS:3und80.de, DNS:ohmygodpresents.co.uk, DNS:example1.com .. , , .