Setting up imaps with haproxy and local certs?

[lukastribus]

This only works for ports with implicit SSL. It cannot work with STARTTLS based approaches:

Terminating opportunistic TLS (STARTTLS)

No, because this is negotiated at application layer which means haproxy would actually have to implement at least a part of the handshake of every single one of those protocols. No, because there would already have been a POP/IMAP/SMTP handshake with some other backend. For this to work haproxy would have to intercept the handshake of all those protocols and insert a STARTTLS negotiation.

SMTP & IMAP proxy based on domain (pass-through)

No, this is not really possible, because you have to support a) cleartext and b) STARTTLS, neither allows SNI based routing decisions, because the SNI value, if it exist at all, is not in the first packet. You can only do this with implicit TLS, meaning imaps on TCP Port 993 and SMTP submission with implicit TLS on port 465. Port 587 is unencrypted until you start the TLS session with STARTTLS. It’s therefor impossible to route based on SNI. I don’t think SNI contains the domain. It usually …