How to Generate a CSR on Courier IMAP Server

This tutorial shows you how to generate a CSR (Certificate Signing Request) on a Courier IMAP server with OpenSSL. The certificate you obtain from this CSR secures the TLS connections your mail clients use for IMAP, POP3, and SMTP, so credentials and messages travel encrypted between the client and your server.

Generate a CSR on Courier IMAP Server

If you have already generated your CSR and received your certificate files from the Certificate Authority, skip this guide and go straight to installing the SSL certificate on Courier IMAP Server.

A CSR is a block of encoded text that carries the domain and organization details you want to certify. You send it to a Certificate Authority (CA) when you order a certificate. Generating the CSR also creates a matching private key that stays on your server. You need that key to install the certificate later, so do not delete or move it.

You can generate the CSR from the command line with OpenSSL, as shown below, or use our CSR Generator to produce the CSR and key in your browser.

Step 1: Run the OpenSSL command

Connect to your server over SSH and run the command below. It generates a new 2048-bit RSA private key and a matching CSR in the current directory:

openssl req -new -newkey rsa:2048 -nodes \
  -keyout mail.yourdomain.com.key \
  -out mail.yourdomain.com.csr \
  -addext "subjectAltName=DNS:mail.yourdomain.com,DNS:imap.yourdomain.com,DNS:smtp.yourdomain.com"

The -addext option adds a Subject Alternative Name (SAN) to the request. This is not optional: browsers and mail clients match the server hostname against the SAN, not the Common Name, so the certificate must list every hostname clients use. Include every hostname your mail clients connect to, separated by commas.

Use the hostnames your clients actually use for IMAP, POP3, and SMTP, for example mail.yourdomain.com, imap.yourdomain.com, and smtp.yourdomain.com. If all three services share one hostname, list just that name. Avoid using your bare website domain unless mail clients connect to it directly.

Two notes on the command itself: rsa:2048 is the smallest key size public CAs accept, and you can raise it to rsa:4096 for a larger key. The -nodes option writes the key without a passphrase, which Courier needs because it loads the key at startup without prompting.

Step 2: Answer the prompts

OpenSSL then asks for the details that make up the certificate’s Distinguished Name. It asks for them in this order:

• Country Name (2 letter code): the two-letter ISO code for your country, for example US or GB.
• State or Province Name: the full state or province name, not an abbreviation.
• Locality Name: the city where your organization is registered.
• Organization Name: the legal name of your organization, for example GPI Holding LLC.
• Organizational Unit Name: leave this blank and press Enter. Public CAs no longer include the OU field.
• Common Name: the primary mail hostname you are securing, for example mail.yourdomain.com. It should match one of the SAN names from Step 1.
• Email Address: optional. You can leave it blank, as public CAs do not include it in the certificate.

After the Distinguished Name, OpenSSL asks for two extra attributes: A challenge password and An optional company name. Leave both blank and press Enter. Public CAs do not use them.

If a prompt shows a value in square brackets, that is a default: press Enter to accept it or type a new value. Do not leave the whole Distinguished Name empty, because some OpenSSL builds then refuse to write the CSR. At a minimum, fill in the Country, Organization, and Common Name.

Step 3: Copy the CSR and order your certificate

OpenSSL saves two files in the current directory: mail.yourdomain.com.key (your private key) and mail.yourdomain.com.csr (your CSR). Open the CSR in any plain-text editor, or print it to the terminal:

cat mail.yourdomain.com.csr

Copy the entire block, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines. It looks like this:

-----BEGIN CERTIFICATE REQUEST-----
MIICvDCCAaQCAQAwXTELMAkGA1UEBhMCVVMx...
...the encoded body of your request...
-----END CERTIFICATE REQUEST-----

Paste this block into the order form when you buy your certificate. To confirm the details are correct before you submit, run it through our CSR decoder, which shows the Common Name, SAN entries, key size, and organization the CSR contains.

Keep mail.yourdomain.com.key on the server and readable only by root. You will merge it with the issued certificate during installation, and a certificate cannot be installed without its matching private key.

Once the CA issues your certificate, you combine it with this private key and the CA chain into a single PEM file and point Courier’s TLS_CERTFILE setting at it. Our guide on how to install an SSL certificate on Courier IMAP Server covers the full process.