cPanel Exim TLS SNI Multi-Domain Mail Certificates in Pakistan (2026)

On multi-tenant cPanel and reseller hosting servers in Pakistan, one of the most persistent client onboarding complaints is the dreaded mail client security warning:

The server you are connected to is using a security certificate that cannot be verified.
The target principal name is incorrect.
Certificate Name: server1.nexthost.pk
Connected Server: mail.clientdomain.pk
Do you want to continue using this server?

When corporate employees configure Microsoft Outlook, Apple Mail, or Thunderbird to connect via secure IMAP (port 993) or SMTP Submission (port 465/587), they expect to enter their company’s own branded domain name (mail.clientdomain.pk).

If Exim is not properly configured with TLS Server Name Indication (SNI), the mail transfer agent serves the server’s primary fallback hostname certificate instead of the client’s individual domain certificate.

In this enterprise tutorial, we dissect how Exim TLS SNI operates under EasyApache, ensure AutoSSL secures mail subdomains, and verify multi-domain TLS handshakes via OpenSSL CLI.

---

1. How Exim TLS Server Name Indication (SNI) Works

In classic TLS, the encrypted handshake begins before HTTP or SMTP transmits the destination hostname. The mail server could only present a single static SSL certificate tied to the server’s primary fully qualified domain name (FQDN).

With TLS SNI (RFC 6066), the mail client includes the desired destination hostname in the initial ClientHello frame:

[Outlook Client connects to Port 465]
               │
               ▼
[ClientHello with TLS SNI Extension: "mail.enterprise.pk"]
               │
               ▼
[cPanel Exim TLS Engine with SNI Active]
  - Intercepts SNI header: "mail.enterprise.pk"
  - Performs dynamic file lookup: /var/cpanel/ssl/domain_tls/mail.enterprise.pk/
  - Dynamically loads and presents enterprise.pk's SSL Certificate!
               │
               ▼
[Outlook validates Certificate Subject: CN=mail.enterprise.pk]
  - Padlock icon green; ZERO security popups; 100% Seamless Handshake!

Running enterprise corporate email platforms with hundreds of active TLS SNI certificates requires dedicated memory and CPU isolation. Discover our high-performance Dedicated Servers and localized Dedicated Servers in Pakistan engineered for multi-tenant mail hosting.

---

2. Enabling Dynamic Mail SNI in cPanel & WHM

In modern cPanel systems on AlmaLinux or CloudLinux, Exim’s dynamic SNI feature must be active across all user domains.

Step 1: Enable Mail SNI Feature in WHM

1. Log into WHM as root.
2. Navigate to: Home » Service Configuration » Mailserver Configuration.
3. Locate Enable Mail SNI.
4. Set the toggle to On.
5. Save changes to rebuild Exim and Dovecot service definitions.

Step 2: Enable Mail SNI via cPanel CLI for All Existing Domains

If migrating existing accounts from older cPanel servers, enforce SNI across all hosted domains:

# Enable mail SNI globally across all cPanel accounts
whmapi1 enable_mail_sni_for_all_users

# Rebuild Exim TLS configuration mapping
/scripts/buildeximconf
systemctl restart exim

---

3. Automating AutoSSL for mail. Subdomains

For Exim SNI to function, each domain must possess a valid, active SSL certificate that explicitly covers the mail. subdomain (e.g. mail.clientdomain.pk).

Inspecting cPanel AutoSSL Configuration via CLI:

# Check AutoSSL status for a specific user
whmapi1 get_autossl_user_excluded_domains user=clientuser

Ensure mail.clientdomain.pk is not on the exclusion list:

# Force AutoSSL check and certificate issuance for the user
/usr/local/cpanel/bin/autossl_check --user=clientuser

Once AutoSSL succeeds, cPanel automatically writes the certificate and private key files into:

/var/cpanel/ssl/domain_tls/mail.clientdomain.pk/combined

When Exim receives a TLS connection requesting mail.clientdomain.pk, it dynamically pulls this certificate file into memory.

---

4. Verifying Exim SNI Handshakes via OpenSSL CLI

You can verify that Exim serves the correct custom certificate for any hosted Pakistani domain using openssl s_client with the -servername flag:

# Query Exim on SMTP Submission (Port 465) with explicit SNI
openssl s_client -connect mail.clientdomain.pk:465 -servername mail.clientdomain.pk </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Expected Output:

subject=CN = mail.clientdomain.pk
issuer=C = US, O = Let's Encrypt, CN = R11
notBefore=Oct  4 12:00:00 2026 GMT
notAfter=Jan  2 12:00:00 2027 GMT

Verifying Dovecot Secure IMAP (Port 993):

# Query Dovecot IMAP with explicit SNI
openssl s_client -connect mail.clientdomain.pk:993 -servername mail.clientdomain.pk </dev/null 2>/dev/null | openssl x509 -noout -subject

subject=CN = mail.clientdomain.pk

Both Exim and Dovecot return the client’s branded domain certificate, eliminating all client-side security warnings.

---

5. Architectural Recommendations for Pakistani Hosting Providers

1. Mandate CAA DNS Records with AutoSSL Authorization: If using external nameservers (such as Cloudflare or Route 53), ensure client domains have CAA records permitting letsencrypt.org or sectigo.com to prevent AutoSSL issuance failures.
2. Prevent Reverse DNS (rDNS) Conflicts: While clients connect via mail.clientdomain.pk over SNI, the server’s outgoing SMTP HELO/EHLO identity must match the server’s primary PTR record to satisfy Google and Yahoo spam filters.

For deep explorations of cPanel mail infrastructure and search performance, review our technical articles on cPanel Dovecot Solr Full-Text Search Tuning and cPanel Exim Dynamic Outgoing Rate Limiting. If you run isolated microservices, check our performant Cloud VPS offerings.

---