Enabling Secure IMAP and POP3 with Dovecot

1. Obtain a certificate, using the server name for the Common Name (CN). This name should correspond to what the clients (Outlook, Mozilla, etc) are using as their POP3 or IMAP server setting.

   Upon completion you will have a private-key file (host.key) and public-key (certificate) file (host.cert). Rename the files as needed, or adjust the values in the next step.

2. Move the certificate and private-key to where dovecot expects to find them. The exact location may vary depending on your operating system. Create the parent directories of necessary.

   mv frank.crt /etc/ssl/certs/imapd.crt
   mv frank.key /etc/ssl/private/imapd.key
   chown root /etc/ssl/private/imapd.key
   chmod 600 /etc/ssl/private/imapd.key
   

3. Make the following adjustments to dovecot.conf

   protocols = imaps pop3s
   ssl_disable = no
   ssl_cert_file = /etc/ssl/certs/imapd.crt
   ssl_key_file = /etc/ssl/private/imapd.key
   

4. To enable certificate trust to work correctly, you may need to load the signing certificate (aka CA certificate) onto each client. You may download the Credentia CA certificate from here. Other CA certificates (VeriSign, Thawte, Geotrust etc) are typically already inside the certificate store.

5. Configure each email client to use SSL for IMAP (port 993) or POP3 (port 995).

See Also