Securing Email Servers with SSL/TLS

To secure the POP3, IMAP, and SMTP protocols with SSL/TLS encryption, you can configure an SSL/TLS certificate in Plesk for all email-based services. The certificate is used for both SSL/TLS connections and STARTTLS connections for all protocols.


Logging In to the Plesk Control Panel

For instructions on logging in to the Plesk Control Panel, please refer to the following article: Logging In to the Plesk Control Panel.



Configuring a Global SSL/TLS Certificate

Navigate to the menu item Tools & Settings → SSL/TLS Certificates and select the [Change] button in the “Certificate for Email Security” section.



In the next step, select the desired SSL/TLS certificate for the mail server:


Then click “OK” to apply the changes.




Domain-Based SSL/TLS Certificates for Email

In addition to the global SSL/TLS certificate, Plesk also allows you to configure separate certificates for the IMAP, POP3, and SMTP email services using SNI (Server Name Indication) technology.


To do this, navigate to Websites & Domains → Your Domain → Email → Email Settings


Select the desired certificate from the “SSL/TLS Certificate for Email” dropdown menu. Then click the OK button to save your changes.



Note: Depending on the cipher negotiation, the custom SNI certificate may not be supported. In this case, the global certificate for email will be used even if a domain-based certificate is configured. Therefore, make sure you have configured a valid global certificate.



Default Ports

Plesk provides the protocols for the email service on the following ports:

Protocol Port Encryption
POP3 110 None / STARTTLS
POP3S 995 SSL/TLS


Protocol Port Encryption
IMAP 143 None / STARTTLS
IMAPS 993 SSL/TLS


Protocol Port Encryption
SMTP 25 None
SMTPS 465 SSL/TLS
SMTPS 587 STARTTLS