Can nginx be an mail proxy for a backend server that does not accept cleartext logins?

Solution 1:

You can just use the stunnel service in client mode to listen for unencrypted traffic at localhost and then pass it on to the SSL backend.

Example configuration:

[gmail-pop3]
client = yes
accept = 127.0.0.1:1110
connect = pop.gmail.com:995

Then point nginx to localhost:1110 as backend and it will in fact connect to GMail's POP3 server over SSL.

Solution 2:

Someone has been working on a branch which implements SSL backend support, I believe it is still experimental and is built against 1.0.11 but it should be at least one to watch: https://github.com/druga/unuzbl/tree/master/nginx-temp

Solution 3:

Not really an answer to your question but it may help future readers like me.

Perdition is another mail proxy that is able to handle both plain-text and SSL/TLS encrypted connections.

A quick presentation of both nginx and perdition: http://fr.slideshare.net/jpmens/the-perdition-and-nginx-imap-proxies