How to assign an SSL certificate per domain to secure the mail server in Plesk (SNI support)?

Question

How to assign an SSL certificate per domain to secure the mail server in Plesk (SNI support)?

Answer

Requirements

Warning: If you're switching from Courier to Dovecot be aware of potential issues.

1. Log into Plesk

2. Issue a Let's Encrypt certificate for a domain, or upload a paid certificate

3. For each of the domains that should have a separate mail certificate, navigate to Domains > example.com > Mail > Mail Settings

4. Select the domain's certificate in SSL/TLS certificate for mail dropdown:

   

5. Click on Apply

6. Verify that the separate mail certificate is used:

   • On Windows:

     1. Connect to the server via RDP

     2. Run OpenSSL with the mail server's domain and check the certificate's CN field:

        PS echo 'Q' | plesk sbin openssl s_client -connect localhost:465 -servername example.com -showcerts 2>&1 | SLS -Pattern 'CN=[^/]+' | % { $_.Matches } | % { $_.Value } | Get-Unique
        CN=example.com

   • On Linux:

     1. Connect to the server via SSH

     2. Run OpenSSL with the mail server's domain and check the certificate's CN field:

        # echo 'Q' | openssl s_client -connect localhost:465 -servername example.com -showcerts 2>&1 | grep -Eo 'CN=[^/]+' | uniq
        CN=example.com