10-11-2026, 12:06 PM
Mail clients need a trusted certificate covering the server hostname they connect to, such as mail.example.com. A certificate covering only example.com and www.example.com is not sufficient for mail.example.com.
Lab result: A certificate for mail.adminslab.com was issued and deployed to the mail services. IMAP on port 993 and SMTP STARTTLS on port 587 both passed hostname and certificate-chain verification. The web site continued returning HTTP 200.
1. Check DNS and the certificate names
Create the mail hostname A record pointing to your VPS and keep it DNS only on Cloudflare. Check whether you already have a valid certificate that explicitly includes mail.example.com. Do not select the website certificate merely because it belongs to the same parent domain.
2. Issue a hostname certificate
Our lab used an HTTP-01 certificate issued through aaPanel's Website feature:
1. Open Website and click Add site.
2. Enter mail.example.com as the domain.
3. Use a separate directory for this hostname. Do not replace an existing website's files.
4. Leave FTP and database creation disabled for a validation-only site.
5. Keep Apply for SSL selected and submit.
6. Wait until the site appears with a valid certificate and a remaining-days value.
Port 80 must be reachable for HTTP-01 validation. If you cannot use HTTP-01, aaPanel also offers DNS verification under Domains → SSL Certificate → Let's Encrypt. Manual DNS validation requires adding the exact challenge TXT record and needs a renewal plan; aaPanel warns that manually resolved certificates do not support automatic renewal.
3. Deploy the certificate to Mail Server
Open Mail Server → Mail Domain and select the SSL status on the domain row. The dialog offers Other certificate and Apply for SSL.
If an existing matching certificate is offered, inspect its certificate-domain list before selecting Deploy. In our lab that automatic selection initially offered only the root/www certificate, so we did not deploy that mismatched certificate.
For a separately issued mail-host certificate, use Other certificate: paste its matching private key into KEY and its full certificate chain into CRT/PEM, then save. Obtain both from the same certificate entry. Never share the private key or put it in a tutorial screenshot. Our lab deployment was performed through the official mail plugin's certificate method; the encrypted-service checks below confirmed the result.
4. Test the mail endpoints
Configure clients with mail.example.com, not the bare IP. Check IMAP TLS on 993 and SMTP STARTTLS on 587. The certificate should be trusted, unexpired and valid for that exact hostname. A working HTTPS website alone does not verify these mail endpoints.
Renewal and troubleshooting
Monitor expiry and confirm that renewed files are redeployed to Postfix and Dovecot. Issuing a renewed website certificate does not by itself prove the mail-service copy was refreshed. Retest both endpoints after renewal.
A name mismatch means the certificate lacks the hostname used by the client. An incomplete chain means intermediate certificates may be missing. A connection timeout requires checking the service, server firewall and provider firewall. Do not disable certificate verification to conceal an error.
Screenshot: mail-domain SSL status
![[Image: mail-domain-branded-20261011.png]](https://adminsforum.com/uploads/tutorials/mail-domain-branded-20261011.png)
Start here: Add a Mail Domain in aaPanel Free Edition
Lab result: A certificate for mail.adminslab.com was issued and deployed to the mail services. IMAP on port 993 and SMTP STARTTLS on port 587 both passed hostname and certificate-chain verification. The web site continued returning HTTP 200.
1. Check DNS and the certificate names
Create the mail hostname A record pointing to your VPS and keep it DNS only on Cloudflare. Check whether you already have a valid certificate that explicitly includes mail.example.com. Do not select the website certificate merely because it belongs to the same parent domain.
2. Issue a hostname certificate
Our lab used an HTTP-01 certificate issued through aaPanel's Website feature:
1. Open Website and click Add site.
2. Enter mail.example.com as the domain.
3. Use a separate directory for this hostname. Do not replace an existing website's files.
4. Leave FTP and database creation disabled for a validation-only site.
5. Keep Apply for SSL selected and submit.
6. Wait until the site appears with a valid certificate and a remaining-days value.
Port 80 must be reachable for HTTP-01 validation. If you cannot use HTTP-01, aaPanel also offers DNS verification under Domains → SSL Certificate → Let's Encrypt. Manual DNS validation requires adding the exact challenge TXT record and needs a renewal plan; aaPanel warns that manually resolved certificates do not support automatic renewal.
3. Deploy the certificate to Mail Server
Open Mail Server → Mail Domain and select the SSL status on the domain row. The dialog offers Other certificate and Apply for SSL.
If an existing matching certificate is offered, inspect its certificate-domain list before selecting Deploy. In our lab that automatic selection initially offered only the root/www certificate, so we did not deploy that mismatched certificate.
For a separately issued mail-host certificate, use Other certificate: paste its matching private key into KEY and its full certificate chain into CRT/PEM, then save. Obtain both from the same certificate entry. Never share the private key or put it in a tutorial screenshot. Our lab deployment was performed through the official mail plugin's certificate method; the encrypted-service checks below confirmed the result.
4. Test the mail endpoints
Configure clients with mail.example.com, not the bare IP. Check IMAP TLS on 993 and SMTP STARTTLS on 587. The certificate should be trusted, unexpired and valid for that exact hostname. A working HTTPS website alone does not verify these mail endpoints.
Renewal and troubleshooting
Monitor expiry and confirm that renewed files are redeployed to Postfix and Dovecot. Issuing a renewed website certificate does not by itself prove the mail-service copy was refreshed. Retest both endpoints after renewal.
A name mismatch means the certificate lacks the hostname used by the client. An incomplete chain means intermediate certificates may be missing. A connection timeout requires checking the service, server firewall and provider firewall. Do not disable certificate verification to conceal an error.
Screenshot: mail-domain SSL status
Start here: Add a Mail Domain in aaPanel Free Edition