How to Install an SSL Certificate on Kerio Connect

In this tutorial, you will learn how to install an SSL certificate on Kerio Connect, importing your signed certificate in the administration console and then setting it as the default certificate for the mail server.

Generate a CSR code on Kerio Connect

If you have already generated your CSR and received the SSL files, skip part 1 and jump straight to the installation steps.

CSR stands for Certificate Signing Request, a block of encoded text that contains your contact details. The Certificate Authority (CA) uses the CSR to verify your credentials before issuing your certificate. Generating the CSR also creates the matching private key, which stays on the server. You have two options:

• Use our CSR Generator to create the CSR automatically.
• Follow our step-by-step tutorial on how to generate a CSR on Kerio Connect.

When you order, copy the entire CSR text, including the BEGIN and END lines, and paste it into the box on the SSL certificate order page. Important: generate the CSR inside Kerio Connect itself. The Import Signed Certificate from CA option is grayed out unless a matching certificate request already exists on the same server, since the signed certificate has to pair with the private key created alongside that request.

Install an SSL certificate on Kerio Connect

After the CA validates your request and issues the certificate, download the ZIP archive and extract it on your computer. You should have your primary (server) certificate and one or more intermediate (CA) certificates. Kerio Connect expects the certificate as X.509 Base64 in text (PEM) format with a .crt file extension, which is the standard format most Certificate Authorities supply.

Step 1: Import the signed certificate

Log in to the Kerio Connect administration console and go to Configuration > SSL Certificates. Click Import > Import Signed Certificate from CA, then select the .crt server certificate file you received from the CA and confirm.

If you are importing an existing certificate and its private key from another system (rather than one issued from a CSR created here), use the import option that includes the key, and supply the key in PEM format.

Step 2: Set the certificate as default

Importing the certificate does not activate it on its own. In the SSL Certificates list, select the certificate you just imported and click Set as Default. In older Kerio Connect builds this button is labeled Set as Active. This tells the mail server to present this certificate for secured connections (SMTP, IMAP, POP3, and the web client).

Step 3: Add the intermediate (CA) certificates

The server certificate alone is not enough; clients need the intermediate chain to trust it. Kerio Connect gives you two ways to install the chain. Use whichever you prefer.

Method A: place the intermediates in the sslca folder. Stop the Kerio Connect server, copy each intermediate certificate file into the sslca folder, then start the server again. The sslca folder should contain only intermediate certificates. Its location depends on your operating system:

• Windows: C:\Program Files\Kerio\MailServer\sslca
• macOS: /usr/local/kerio/mailserver/sslca
• Linux: /opt/kerio/mailserver/sslca

Method B: combine the server and intermediate certificates into one file

If you would rather manage a single file, merge your server certificate with the intermediate certificate(s) before importing:

• Open your issued server .crt file in a plain-text editor (Notepad on Windows, or nano or vi on Linux and macOS).
• Paste the intermediate certificate directly below the server certificate. If the CA supplied more than one intermediate, paste them in order, each below the previous one.
• Save the file, then import and apply it in Kerio Connect.

The combined file should look like this, with the server certificate first and the intermediate(s) below it:

-----BEGIN CERTIFICATE-----
... contents of your server certificate ...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... contents of your intermediate certificate ...
-----END CERTIFICATE-----

Each BEGIN CERTIFICATE and END CERTIFICATE marker line uses exactly five hyphens on each side, with no spaces and no extra characters. A mangled marker line is the most common reason an import or chain fails.

After you set the certificate as default and install the chain, restart Kerio Connect so the new certificate is served. A restart is also required after a renewal or re-issue, even when the domain has not changed. That’s it. Your SSL certificate is now installed and active on Kerio Connect.

Test your SSL installation

After installing the certificate on Kerio Connect, run an SSL scan to confirm the certificate and the full intermediate chain are served correctly and to catch any errors. Because Kerio Connect secures several services, test the relevant ports: the web client on 443, secure IMAP on 993, secure POP3 on 995, and SMTP submission on 465 or 587. Use our SSL Checker to test your SSL certificate.

Frequently Asked Questions