SSL on IMAP/POP3/SMTP

[#1]

Quote from: Bob

If you can hold out and be patient for just a while longer though, then you never know, Santa might just show up with an early Christmas present.

Good!  How will we know that he has paid a visit?  Please would you let us know in this thread .

[#2]

Quote from: machare

Good!  How will we know that he has paid a visit?  Please would you let us know in this thread .

<cynic>Because there will be a service status announcement for work on the mail servers following which we'll have a load of issues with them until the gremlins are sorted out.</cynic>

[#3]

Well Bob did say Community would be the first to know, so maybe the Service Status text will be posted here a few seconds before the announcement is issued.

[#4]

I'm sure Bob will give you an update when he can.

[#5]

Really happy that there's some sign of this (finally...) being provided - as per my replies in the other long-running thread on this, it's my only real gripe with the whole PlusNet service and product.
Thanks in anticipation!

[#6]

Quote from: Chris

I'm sure Bob will give you an update when he can.

A few of you should find a message from me in your PM inbox

[#7]

... and for the rest of us who have not received a notification in our inbox?
The prolonged lack of action on this issue is indefensible in the current climate of continuous attacks on security.  The recommended alternative, Plusnet Webmail, is virtually unusable on a tablet, so the only way of securely accessing your email with such a device when away from home is via a VPN, which is slow and very inconvenient.

[#8]

As a rough guess, those that received a message are taking part in an initial trial,  hopefully it won't be long before a wider trial is started,  before finally rolling it out officially.
For the moment,  I guess the rest of us are going to wait,  and hope those that have shown an interest in this subject may still be invited into the trials.
Customers have been askingfor this for more than 5 years  (I would say more than 7 but entries that old have been archived),  it does at least appear we're almost there.

[#9]

Quote from: davec13

... and for the rest of us who have not received a notification in our inbox?

I think @kmilburn may be on the right track.     A tad more patience may be all that is needed?

Maurice

[#10]

Quote from: kmilburn

Customers have been askingfor this for more than 5 years  (I would say more than 7 but entries that old have been archived)

Try NINE years ! - "IMAP and SSL" 

[#11]

Odd the way Google always find the print version! If you take the printpage out of the URL you get the normal page: http://community.plus.net/forum/index.php?topic=39712.0

[#12]

@davec13 @kmilburn, I've just dropped you both a message.

[#13]

Buy a cert ... surely PN can afford it.
These are the config lines required for dovecot (other pop/imap servers will be similar)
    ssl_key  = <......./cert.key
    ssl_cert = <......./combined.crt
Seriously, how hard can it be? 
As a sysadmin, if I didn't offer TLS on the university mail servers, I'd have been fired years ago.

[#14]

Putting a cert on the BE servers is easy as pie.
Putting a cert on the Load Balancers seems to be the problem.
Then there's the decisions of "do we need certs on the BE servers, so that everything is encrypted, or do we just run TLS to the FE Load Balancers and leave everything clear within our network?".
Don't forget that the BE servers are probably configured to use more than one hostname (mail.plus.net, mail.f9.co.uk, mail.force9.co.uk, etc), so there would need to be more than one IP on those hosts for each hostname if they went for full encryption.
BUT there is no reason those internal certs couldn't be signed by an internal CA (unless the FE Load Balancers couldn't import the internal root CA cert).
As with many things PlusNet, we can only speculate as they don't seem to want to share any technical details about any problems or stumbling blocks.

I'd LOVE for Bob to come back and say "The problem is that our XYZ front facing hardware doesn't support TLS and replacing it is unprofitable" or "Our front facing hardware doesn't support multiple IPs for TLS, so we'd need to buy 6 more for each vhost we're using".
Given that people have been invited in PM to this trial, I can only assume they are now using a different hostname, and therefore a different route in / set of hardware.
All I want for Christmas is to not be treated like a novice and given some real explanations!
Merry Xmas!

[#15]

Am watching my PM box with egar anticipation!
Out of interest, is the implementation at account level, mailbox level or even just device level?
I have multiple email boxes accessed by multiple devices.  When implemented will this be an "all or nothing" option, that is will all devices accessing any mailbox on the account HAVE to use SSL?