Devices & Servers · Mail servers & webmail
Stop Outlook and every phone warning about your mail server
Outlook, Apple Mail and every phone in the building check your certificate before they will sync. Get it wrong and the helpdesk hears about it from everyone at once.
- A mail certificate fails for everybody at onceUnlike a website, a broken mail certificate stops Outlook, ActiveSync and every phone at the same moment. It is the most visible outage in the building.
- Autodiscover needs its own name in the certificatemail, autodiscover and webmail are three separate hostnames. Outlook will not configure itself if any one of them is missing.
- Users are trained to click through the promptApple Mail and Outlook show a certificate prompt most people accept without reading — precisely the behaviour someone on the same Wi-Fi is counting on.
- Add a name later without buying againFree reissues for the whole term, so a mail migration or a new webmail hostname does not mean a second certificate.
- $196.94from, for the shortest term
- 25% offits list price of $262.58
- One certificatemail, autodiscover and webmail
- Every clientOutlook, Apple Mail, iOS, Android
Start with the mail platform you run
The certificate is the same whichever of these you run. What changes is how many hostnames the platform expects to be covered.
- Microsoft Exchange 2016 / 2019 mail · autodiscover · owa Microsoft Exchange, or anything using autodiscover →
- Exchange hybrid with Microsoft 365 hybrid.acme.com Microsoft Exchange, or anything using autodiscover →
- Zimbra Collaboration mail.acme.com One mail host, one hostname →
- MDaemon mail.acme.com One mail host, one hostname →
- Kerio Connect mail.acme.com One mail host, one hostname →
- IceWarp mail.acme.com One mail host, one hostname →
- Postfix and Dovecot smtp · imap One mail host, one hostname →
- hMailServer mail.acme.com One mail host, one hostname →
- Roundcube and SOGo webmail webmail.acme.com Mail, webmail and everything else under one domain →
- cPanel and Plesk mail mail.acme.com Mail, webmail and everything else under one domain →
- SmarterMail mail.acme.com Several mail domains on one server →
- Axigen mail.acme.com Several mail domains on one server →
How many names does your mail need to cover?
Write down every hostname a client will ever ask for — including autodiscover for each accepted domain — before you choose. That list is the whole decision.
Microsoft Exchange, or anything using autodiscover
Exchange is the reason unified communications certificates exist. Outlook looks for autodiscover before it looks for anything else, and a certificate that covers mail but not autodiscover produces a warning on every client, every time.
Typically: mail.acme.com, autodiscover.acme.com, owa, ews and the hybrid endpoint.
Comodo Unified Communications Certificate UCC
The certificate Exchange deployments are normally specified with. Several names included from the start, hundreds available, and organisation vetting on top.
- Organisation validated · issued in 1-3 days
- 5 hostnames included, up to 245 in total
- $250,000 warranty
- Free unlimited reissues for the whole term
Comodo UCC Multi-Domain SSL Certificate
The same multi-name coverage with no company paperwork. Issues in minutes, which is what you want when mail is already warning.
- Domain validated · issued in minutes
- 3 hostnames included, up to 247 in total
- $25,000 warranty
- Free unlimited reissues for the whole term
One mail host, one hostname
A single Postfix, Zimbra or MDaemon server answering on one name needs one certificate. SMTP, IMAP and POP all present the same file, so covering that one name covers all three services.
Typically: One server, one public hostname, no autodiscover requirement.
Comodo PositiveSSL Certificate
One hostname, publicly trusted by every mail client there is, issued in minutes.
- Domain validated · issued in minutes
- $10,000 warranty
- Free unlimited reissues for the whole term
Comodo EssentialSSL Certificate
The same single-name coverage under the EssentialSSL brand, with immediate issuance.
- Domain validated · issued immediately
- $10,000 warranty
- Free unlimited reissues for the whole term
Several mail domains on one server
Hosting mail for more than one company or brand means each domain wants its own hostname on the certificate — and if you run Exchange, its own autodiscover name too. A multi-domain certificate lists them all explicitly.
Typically: mail.acme.com, mail.acme.co.uk, mail.secondbrand.com and their autodiscover names.
Comodo PositiveSSL Multi-Domain Certificate
Starts with three names and takes many more. By a distance the cheapest way to put several mail domains on one certificate.
- Domain validated · issued in minutes
- 3 hostnames included, up to 247 in total
- $10,000 warranty
- Free unlimited reissues for the whole term
Comodo Multi-Domain SSL Certificate SAN OV
The same multi-domain coverage with your registered company vetted and written into the certificate.
- Organisation validated · issued in 1-3 days
- 3 hostnames included, up to 245 in total
- $250,000 warranty
- Free unlimited reissues for the whole term
Mail, webmail and everything else under one domain
If mail is one part of a wider estate under a single domain, a wildcard covers the mail host, webmail, the control panel and anything you add later. Read the autodiscover caveat below first.
Typically: mail, webmail, smtp, imap and the rest of acme.com on one file.
Comodo PositiveSSL Wildcard Certificate
Unlimited subdomains of one domain. One file for the mail server, webmail and every other host you run under it.
- Domain validated · issued in minutes
- Covers unlimited subdomains of the domain
- $10,000 warranty
- Free unlimited reissues for the whole term
Comodo EssentialSSL Wildcard Certificate
The same wildcard coverage under a different brand, worth comparing on term price.
- Domain validated · issued immediately
- Covers unlimited subdomains of the domain
- $10,000 warranty
Mail-specific things that catch people out
A wildcard does not solve autodiscover across several domains
This is the most expensive mistake on this page. *.acme.com covers autodiscover.acme.com and nothing else. If you accept mail for three domains, Outlook will ask for autodiscover under all three, and each one needs its own name on the certificate. Multi-domain, not wildcard.
Internal Exchange names have to come off the certificate
Older Exchange builds put server01.acme.local into the certificate request automatically. No public certificate authority may sign that any more. Set the internal Autodiscover URI and the internal virtual directory URLs to your external hostname, then request the certificate for public names only.
Mail clients are far less forgiving than browsers about the chain
A desktop browser will often paper over a missing intermediate certificate; SMTP clients and phone mail apps will not, and the failure looks like an authentication problem rather than a certificate one. Install the full chain, then confirm it with the SSL Checker.
Questions we get asked about this
How many names do I need for Exchange?
For a single-domain deployment, usually two: your mail hostname and autodiscover. Add owa and ews if you publish them on separate names, and add one autodiscover name for each additional accepted domain.
Can I use a wildcard on Exchange?
Yes, for a single domain, and it works well. It stops working the moment you accept mail for a second domain, because that domain needs its own autodiscover name.
Will this stop the Outlook certificate warning?
It stops it if every name Outlook requests appears on the certificate and the full chain is installed. If a warning survives the install, it is almost always a missing name or a missing intermediate — both are free to fix with a reissue.
Does this encrypt the messages themselves?
No. A server certificate encrypts the connection between client and server. Encrypting and signing individual messages is S/MIME, which is a different product bought per mailbox — ask us and we will point you at the right one.
Something else on the network?
The same certificates cover the rest of the estate. These pages start from the hardware rather than from the certificate.
- Firewalls, VPN & routers FortiGate, SonicWall, Palo Alto, pfSense, Cisco ASA
- Voice: PBX, UCM & SBC Cisco UCM, 3CX, FreePBX, session border controllers
- Mail servers & webmail Exchange, autodiscover, Zimbra, smtp, imap
- Intranet & internal apps Staff portals, Jira, GitLab, dashboards, RDS
- NAS, hypervisor & consoles Synology, QNAP, VMware, Proxmox, iLO, iDRAC
- Web & app servers IIS, Apache, Nginx, Tomcat, load balancers
Send us the hostname list and we will price it up
Tell us what each box is and which names it answers on. We come back with the cheapest combination that genuinely covers the estate — and say so if that is fewer certificates than you were about to buy.