E-mail via a secure tunnel

Connect to e-mail via unsecured ports

If you need to connect to POP3, IMAP or SMTP over unencrypted ports, we do not offer that directly on the server, for security reasons. It is however possible to build a "tunnel" inside your own computer and connect through it. The "tunnel" "listens" for incoming communication on an unsecured (unencrypted) port, then encrypts it and forwards it to a secure port. Everything happens on your computer, so only encrypted communication leaves it.

1 - stunnel installation

First you need to install the stunnel program: http://www.stunnel.org/downloads.html?extra=/binaries.html , select installer from the list, download and install it for all users.

During the installation, the program will ask you for the data needed to create your own RSA key.

2 - stunnel configuration

Once the installation is complete, add stunnel as a service to run at startup by using: Start->Programs(all programs)->stunnel->stunnel Service Install

Then you will need to edit the stunnel.conf file where we configure the settings for pop3, imap, and smtp connections. You will find it in the folder C:/Program Files (x86)/stunnel/config (or C:/Program Files/stunnel/config). Add these three sections at the end of the file:

[platon-pop3s]
client = yes
accept = local.mail:110
connect = pop3s.platon.sk:995
verify = 2
CAfile = ca-certs.pem
checkHost = pop3s.platon.sk
OCSPaia = yes

[platon-imaps]
client = yes
accept = local.mail:143
connect = imaps.platon.sk:993
verify = 2
CAfile = ca-certs.pem
checkHost = imaps.platon.sk
OCSPaia = yes

[platon-smtps]
client = yes
accept = local.mail:25
connect = smtps.platon.sk:465
verify = 2
CAfile = ca-certs.pem
checkHost = smtps.platon.sk
OCSPaia = yes

3 - edit /etc/hosts

Now we need to add a local.mail record to the system hosts file. Open the hosts file, which is in the folder C:/Windows/System32/drivers/etc

Insert the following line at the end of the hosts file:
127.0.0.110 local.mail
(you can also use another IP address from the range 127.0.0.1-127.255.255.255 if you need stunnel to listen on a different IP address)

Save the hosts file.

If the e-mail program, or the software in which you want to set up the connection over unsecured ports, was running while you edited and saved the hosts file, you need to restart it so that it picks up the new settings.

4 - start stunnel and verification

Now we start the stunnel service using Start->Programs(All programs)->stunnel->stunnel Service Start (if you have not installed the service yet, do it first with Service Install)

Then check that everything works.
Run the "cmd" program from the Start search and type the command:
netstat -an |grep "TCP" |grep "127.0.0.110:[12][145]"

If you have a version of Windows that does not support the "grep" command (if you receive an error) just run the command: netstat -an and browse the entire listing.

You should see the following lines in the listing. If you do not see them, try to check if you saved stunnel.conf file correctly and if you have installed and started the service. If you need to edit something, stop and restart the service.

C:/WINDOWS/system32>netstat -an |grep "TCP" |grep "127.0.0.110:[12][145]"
TCP 127.0.0.110:25 0.0.0.0:0 LISTENING
TCP 127.0.0.110:110 0.0.0.0:0 LISTENING
TCP 127.0.0.110:143 0.0.0.0:0 LISTENING

5 - e-mail configuration

Once everything works, in the e-mail programs where you want to use unsecured ports you only need to enter the server "local.mail" instead of our "smtps/pop3s/imaps.platon.sk" servers, and the port 25/110/143 depending on which one you need. You no longer need to enable encryption in the client, because stunnel already handles it. The login details are the same as when you sign in the standard way, that is the e-mail address as the login, and your password. You should be able to receive and send mail without any problems.