Knowledge Base

How to Generate a CSR and Install a SSL Certificate in MDaemon

Updated on June 13, 2026

Overview

By the end of this article, you will have a Sectigo SSL certificate generated, issued, and bound to your MDaemon mail services so that client connections are encrypted. The article covers, in order: generating a Certificate Signing Request (CSR) with the Windows certreq.exe tool, submitting it to your Certificate Authority (CA), accepting and installing the issued certificate, installing the intermediate and root certificates, binding the certificate to MDaemon services, and verifying the result.

Prerequisites

Before you begin, ensure you have:

Administrator access to the Windows server hosting MDaemon

Access to certreq.exe (included with Windows)

Your certificate subject details, including the Common Name (CN), organization, and location

The hostname clients will use (for example, mail.example.com)

The issued certificate files from your Certificate Authority (CA), including the server certificate and any intermediates

Part 1: Generate a CSR with certreq.exe

Step 1 — Create the CSR configuration file

Create a file named CSRParameters.inf at C:\CSRParameters.inf with the following content. Update the subject fields to match your organization:

[NewRequest]
Subject="CN=mail.example.com,OU=IT,O=Example Corp,S=State,L=City,C=IN"
KeySpec=1
KeyLength=2048
Exportable=TRUE
MachineKeySet=TRUE
SMIME=False
PrivateKeyArchive=FALSE
UserProtected=FALSE
UseExistingKeySet=FALSE
ProviderName="Microsoft RSA SChannel Cryptographic Provider"
ProviderType=12
RequestType=PKCS10
KeyUsage=0xa0
Silent=TRUE
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1

Step 2 — Generate the CSR file

In Command Prompt, run:

C:\> certreq -new CSRParameters.inf CSROutput.pem

This creates CSROutput.pem, which contains your CSR.

Step 3 — Submit the CSR to your Certificate Authority

Open CSROutput.pem, copy its contents, and paste them into Sectigo’s CSR submission form. Complete validation to receive your issued SSL certificate files.

Part 2: Install and bind the issued certificate

Step 1 — Accept and install the certificate

After you receive the certificate (for example, mail.example.com.crt), save it to C:\ and run:

C:\> certreq -accept mail.example.com.crt

This associates the issued certificate with the private key created in Part 1.

Step 2 — Install intermediate and root certificates

Install the intermediate and root certificates into the server’s certificate store to avoid trust-chain errors.

Step 3 — Bind the certificate in MDaemon

Open the MDaemon Console.

Go to Security → SSL & TLS → SSL Certificate Manager.

Select the installed certificate.

Bind it to the MDaemon services that need it, such as Simple Mail Transfer Protocol (SMTP), Internet Message Access Protocol (IMAP), and HTTPS.

Apply the changes, and restart MDaemon services if prompted.

How to verify success

The installation is successful when MDaemon lists the certificate as bound and reports no certificate errors after a restart. Confirm the certificate appears and is bound to your services in MDaemon, restart MDaemon, and check that no certificate-related errors appear. Optionally, use an external SSL checker such as SSL Labs to confirm the Common Name (CN), Subject Alternative Name (SAN), and trust chain.

Quick commands reference