CiviCRM Community Forums (archive)

Hi,

A client has Exchange server set up.  We are configuring EmailProcessor.php.  The exchange so far has been:

a) Does you application support IMAP over SSL?

b) Yes, the PHP script that will need to connect to and scan the IMAP mailbox supports using SSL for the connection

c) OK, let's buy an SSL certificate.

I'm wondering if c) is a necessary course of action.  I was thinking that in this instance a self signed certificate would be just as secure.  Also, given that the server will have a fixed IP, could we just allow IMAP from a specific IP via a self signed certificate.  And that would be good enough.

I think the problem is that we are moving from an email server that was before this point entirely behind a firewall and we are now exposing it a little to the internet, and so the sys admin is understandably cautious and security conscious.

Would be good to compare with others and hear your opinions on best practice for security in this situation.

Thanks!