diff --git a/Makefile b/Makefile
index da797c21b64faf42039f3787d11b045a912672d4..116ed1fd03ef2b33d756f44869f72d075d5f3d23 100644
--- a/Makefile
+++ b/Makefile
@@ -17,6 +17,7 @@ install:
 	install -m 755 src/${APP}-config ${DESTDIR}${PREFIX}/bin
 	install -m 755 src/${APP}-sec ${DESTDIR}${PREFIX}/bin
 	install -m 755 src/${APP}-addcert ${DESTDIR}${PREFIX}/bin
+	install -m 755 src/${APP}-clientcert ${DESTDIR}${PREFIX}/bin
 	install -m 755 src/${APP}-addlist ${DESTDIR}${PREFIX}/bin
 	install -m 755 src/${APP}-addemail ${DESTDIR}${PREFIX}/bin
 	install -m 755 src/${APP}-renew-cert ${DESTDIR}${PREFIX}/bin
@@ -35,6 +36,7 @@ install:
 	install -m 644 man/${APP}-config.1.gz ${DESTDIR}${PREFIX}/share/man/man1
 	install -m 644 man/${APP}-sec.1.gz ${DESTDIR}${PREFIX}/share/man/man1
 	install -m 644 man/${APP}-addcert.1.gz ${DESTDIR}${PREFIX}/share/man/man1
+	install -m 644 man/${APP}-clientcert.1.gz ${DESTDIR}${PREFIX}/share/man/man1
 	install -m 644 man/${APP}-addlist.1.gz ${DESTDIR}${PREFIX}/share/man/man1
 	install -m 644 man/${APP}-addemail.1.gz ${DESTDIR}${PREFIX}/share/man/man1
 	install -m 644 man/${APP}-renew-cert.1.gz ${DESTDIR}${PREFIX}/share/man/man1
@@ -52,6 +54,7 @@ uninstall:
 	rm -f ${PREFIX}/share/man/man1/${APP}-remote.1.gz
 	rm -f ${PREFIX}/share/man/man1/${APP}-config.1.gz
 	rm -f ${PREFIX}/share/man/man1/${APP}-sec.1.gz
+	rm -f ${PREFIX}/share/man/man1/${APP}-clientcert.1.gz
 	rm -f ${PREFIX}/share/man/man1/${APP}-addcert.1.gz
 	rm -f ${PREFIX}/share/man/man1/${APP}-addlist.1.gz
 	rm -f ${PREFIX}/share/man/man1/${APP}-addemail.1.gz
@@ -71,6 +74,7 @@ uninstall:
 	rm -f ${PREFIX}/bin/${APP}-config
 	rm -f ${PREFIX}/bin/${APP}-sec
 	rm -f ${PREFIX}/bin/${APP}-addcert
+	rm -f ${PREFIX}/bin/${APP}-clientcert
 	rm -f ${PREFIX}/bin/${APP}-addlist
 	rm -f ${PREFIX}/bin/${APP}-addemail
 	rm -f ${PREFIX}/bin/${APP}-renew-cert
diff --git a/debian/source/include-binaries b/debian/source/include-binaries
index adf2df5d80157ed08fdbf370a510d3721e4ae7c6..087091f529462e8079e3e3bb8f967b1c739ade0d 100644
--- a/debian/source/include-binaries
+++ b/debian/source/include-binaries
@@ -4,6 +4,7 @@ man/freedombone-client.1.gz
 man/freedombone-remote.1.gz
 man/freedombone-config.1.gz
 man/freedombone-sec.1.gz
+man/freedombone-clientcert.1.gz
 man/freedombone-addcert.1.gz
 man/freedombone-addlist.1.gz
 man/freedombone-addemail.1.gz
diff --git a/man/freedombone-addcert.1.gz b/man/freedombone-addcert.1.gz
index 38d40f74c421234c81155a6d4a3205cdab04cc02..ad66eaca754ade3fe8c8299a74a38f2c8a1ecacc 100644
Binary files a/man/freedombone-addcert.1.gz and b/man/freedombone-addcert.1.gz differ
diff --git a/man/freedombone-addemail.1.gz b/man/freedombone-addemail.1.gz
index 7c14b2b193b1831eaae5cba971fe684f2285cd5b..84c144cd0e2c5438b9337899dbdbd416b4f69bdc 100644
Binary files a/man/freedombone-addemail.1.gz and b/man/freedombone-addemail.1.gz differ
diff --git a/man/freedombone-addlist.1.gz b/man/freedombone-addlist.1.gz
index 370295f4fe8078c37587fb9b707826b0d6810888..5bda78393409424ba7df6e8d032ae7be864c4ae4 100644
Binary files a/man/freedombone-addlist.1.gz and b/man/freedombone-addlist.1.gz differ
diff --git a/man/freedombone-addxmpp.1.gz b/man/freedombone-addxmpp.1.gz
index 826e80d0cc6ae1714e43e2672f4ed97bfd099f47..eded5a1ab404e934a0ab806740a473a2d8da1bde 100644
Binary files a/man/freedombone-addxmpp.1.gz and b/man/freedombone-addxmpp.1.gz differ
diff --git a/man/freedombone-client.1.gz b/man/freedombone-client.1.gz
index 57b94f26996dee7ef2f948576aa31a154de8219c..45cf90369f2910fcd9f5b0eb8eb6e1688bc31624 100644
Binary files a/man/freedombone-client.1.gz and b/man/freedombone-client.1.gz differ
diff --git a/man/freedombone-clientcert.1.gz b/man/freedombone-clientcert.1.gz
new file mode 100644
index 0000000000000000000000000000000000000000..db58e9728d87ade10cf7f7cbd9916bae0da163e0
Binary files /dev/null and b/man/freedombone-clientcert.1.gz differ
diff --git a/man/freedombone-config.1.gz b/man/freedombone-config.1.gz
index 5fb8b1a1f24e18ebcfe9aa5f00cf252f43624585..38cb8a05301d394d23b3b63eb676bdf687c48991 100644
Binary files a/man/freedombone-config.1.gz and b/man/freedombone-config.1.gz differ
diff --git a/man/freedombone-ignore.1.gz b/man/freedombone-ignore.1.gz
index 536d6abc271fe8e313050f1ca98e0a3704fecdd7..d91f67d900cdea959c2f884a10b95378c341d467 100644
Binary files a/man/freedombone-ignore.1.gz and b/man/freedombone-ignore.1.gz differ
diff --git a/man/freedombone-prep.1.gz b/man/freedombone-prep.1.gz
index 199b4e5fe571bafe49facfdc6aad0ffc5b8b7f52..d9cfb3c88f33e08e677ea852cff5a6461f59c595 100644
Binary files a/man/freedombone-prep.1.gz and b/man/freedombone-prep.1.gz differ
diff --git a/man/freedombone-remote.1.gz b/man/freedombone-remote.1.gz
index 150309b85356b9bb590e69b4863250d847952ca4..6e50ad6144f782b690e58d034c77ce120127b988 100644
Binary files a/man/freedombone-remote.1.gz and b/man/freedombone-remote.1.gz differ
diff --git a/man/freedombone-renew-cert.1.gz b/man/freedombone-renew-cert.1.gz
index d3c1e7c5642d723b8420c2ca569dc872c61eb07b..2266bc20ca45140723a54e9b461ec1a60fa245aa 100644
Binary files a/man/freedombone-renew-cert.1.gz and b/man/freedombone-renew-cert.1.gz differ
diff --git a/man/freedombone-rmemail.1.gz b/man/freedombone-rmemail.1.gz
index 6dfde842b0bc6bc3de8b52ae94f73f9a761bd6ed..37df405a75de14677c6c253ac2953ae88cee1878 100644
Binary files a/man/freedombone-rmemail.1.gz and b/man/freedombone-rmemail.1.gz differ
diff --git a/man/freedombone-rmlist.1.gz b/man/freedombone-rmlist.1.gz
index f644056f683a6d58e57983231c06bcf8e9bb0ea8..670993214da3a508f95317fef8f03994b327f9a7 100644
Binary files a/man/freedombone-rmlist.1.gz and b/man/freedombone-rmlist.1.gz differ
diff --git a/man/freedombone-rmxmpp.1.gz b/man/freedombone-rmxmpp.1.gz
index 595c507cec0cea2826ac6ec60fac83f4fffd62c6..3a0c600a7d380578986bf9ab35c9b4fead06cfa4 100644
Binary files a/man/freedombone-rmxmpp.1.gz and b/man/freedombone-rmxmpp.1.gz differ
diff --git a/man/freedombone-sec.1.gz b/man/freedombone-sec.1.gz
index e528ab14700d23452cccc9802f1bbccb59685e33..2a3977ea38b8df654db49a196200e5837f9ab6e4 100644
Binary files a/man/freedombone-sec.1.gz and b/man/freedombone-sec.1.gz differ
diff --git a/man/freedombone-unignore.1.gz b/man/freedombone-unignore.1.gz
index 3913f49b07c11891515f2a7903da578c8a5b5dc4..2a668e506c7740d5275ed9c9dc29c8180ae10b09 100644
Binary files a/man/freedombone-unignore.1.gz and b/man/freedombone-unignore.1.gz differ
diff --git a/man/freedombone-xmpp-pass.1.gz b/man/freedombone-xmpp-pass.1.gz
index bb014912a33f9ecaf9637e3c1e4448d9d1d0e5a3..4e51da0979a270ef859166442b9231ab1ea0e6e3 100644
Binary files a/man/freedombone-xmpp-pass.1.gz and b/man/freedombone-xmpp-pass.1.gz differ
diff --git a/man/freedombone.1.gz b/man/freedombone.1.gz
index cdfb8888aea0c16278b9c96e1ad677c5e0c638ea..c50218df5d38171933611d7da9ee14fc15aba506 100644
Binary files a/man/freedombone.1.gz and b/man/freedombone.1.gz differ
diff --git a/src/freedombone b/src/freedombone
index 99222970bd96419b8ae6e78e2e9e744f87c7527a..5961e4930e42ea2898fd01b8a68a318b9060ff2f 100755
--- a/src/freedombone
+++ b/src/freedombone
@@ -5655,28 +5655,74 @@ function configure_imap {
   sed -i 's/auth_mechanisms =.*/auth_mechanisms = plain login/g' /etc/dovecot/conf.d/10-auth.conf
   sed -i 's|mail_location =.*|mail_location = maildir:~/Maildir:LAYOUT=fs|g' /etc/dovecot/conf.d/10-mail.conf
 
-  # enable login via client certs
-  # http://strange.systems/certificate-based-auth-with-dovecot-sendmail/
-  #sed -i 's|#auth_ssl_require_client_cert =.*|auth_ssl_require_client_cert = yes|g' /etc/dovecot/conf.d/10-auth.conf
-  #sed -i 's|#auth_ssl_username_from_cert =.*|auth_ssl_username_from_cert = yes|g' /etc/dovecot/conf.d/10-auth.conf
-  #sed -i 's|#ssl_ca =.*|ssl_ca = /etc/ssl/certs/dovecot-ca.pem|g' /etc/dovecot/conf.d/10-ssl.conf
-  #sed -i 's|#ssl_cert_username_field =.*|ssl_cert_username_field = commonName|g' /etc/dovecot/conf.d/10-ssl.conf
-  #if ! grep -q "passdb {" /etc/dovecot/conf.d/10-auth.conf; then
-    #echo '' >> /etc/dovecot/conf.d/10-auth.conf
-    #echo 'passdb {' >> /etc/dovecot/conf.d/10-auth.conf
-    #echo '  driver = passwd-file' >> /etc/dovecot/conf.d/10-auth.conf
-    #echo '  args = /etc/dovecot/passwd-file' >> /etc/dovecot/conf.d/10-auth.conf
-    #echo '  deny = no' >> /etc/dovecot/conf.d/10-auth.conf
-    #echo '  master = no' >> /etc/dovecot/conf.d/10-auth.conf
-    #echo '  pass = no' >> /etc/dovecot/conf.d/10-auth.conf
-    #echo '}' >> /etc/dovecot/conf.d/10-auth.conf
-  #fi
-  #echo "$MY_USERNAME:{plain}::::::nopassword" > /etc/dovecot/passwd-file
-  #freedombone-addcert -h dovecot-ca --ca
   service dovecot restart
   echo 'configure_imap' >> $COMPLETION_FILE
 }
 
+function configure_imap_client_certs {
+  if grep -Fxq "configure_imap_client_certs" $COMPLETION_FILE; then
+      return
+  fi
+  # http://strange.systems/certificate-based-auth-with-dovecot-sendmail/
+  sed -i 's|#auth_ssl_require_client_cert =.*|auth_ssl_require_client_cert = yes|g' /etc/dovecot/conf.d/10-auth.conf
+  sed -i 's|#auth_ssl_username_from_cert =.*|auth_ssl_username_from_cert = yes|g' /etc/dovecot/conf.d/10-auth.conf
+  sed -i 's|#ssl_ca =.*|ssl_ca = /etc/ssl/certs/dovecot-ca.crt|g' /etc/dovecot/conf.d/10-ssl.conf
+  sed -i 's|#ssl_cert_username_field =.*|ssl_cert_username_field = commonName|g' /etc/dovecot/conf.d/10-ssl.conf
+  if ! grep -q "passdb {" /etc/dovecot/conf.d/10-auth.conf; then
+    echo '' >> /etc/dovecot/conf.d/10-auth.conf
+    echo 'passdb {' >> /etc/dovecot/conf.d/10-auth.conf
+    echo '  driver = passwd-file' >> /etc/dovecot/conf.d/10-auth.conf
+    echo '  args = /etc/dovecot/passwd-file' >> /etc/dovecot/conf.d/10-auth.conf
+    echo '  deny = no' >> /etc/dovecot/conf.d/10-auth.conf
+    echo '  master = no' >> /etc/dovecot/conf.d/10-auth.conf
+    echo '  pass = no' >> /etc/dovecot/conf.d/10-auth.conf
+    echo '}' >> /etc/dovecot/conf.d/10-auth.conf
+  fi
+  # make a CA cert
+  if [ ! -f /etc/ssl/private/dovecot-ca.key ]; then
+	  freedombone-addcert -h dovecot-ca --ca
+  fi
+  # CA configuration
+  echo '[ ca ]' > /etc/ssl/dovecot-ca.cnf
+  echo 'default_ca = dovecot-ca' >> /etc/ssl/dovecot-ca.cnf
+  echo '' >> /etc/ssl/dovecot-ca.cnf
+  echo '[ crl_ext ]' >> /etc/ssl/dovecot-ca.cnf
+  echo 'authorityKeyIdentifier=keyid:always' >> /etc/ssl/dovecot-ca.cnf
+  echo '' >> /etc/ssl/dovecot-ca.cnf
+  echo '[ dovecot-ca ]' >> /etc/ssl/dovecot-ca.cnf
+  echo 'new_certs_dir = .' >> /etc/ssl/dovecot-ca.cnf
+  echo 'unique_subject = no' >> /etc/ssl/dovecot-ca.cnf
+  echo 'certificate = /etc/ssl/certs/dovecot-ca.crt' >> /etc/ssl/dovecot-ca.cnf
+  echo 'database = ssldb' >> /etc/ssl/dovecot-ca.cnf
+  echo 'private_key = /etc/ssl/private/dovecot-ca.key' >> /etc/ssl/dovecot-ca.cnf
+  echo 'serial = sslserial' >> /etc/ssl/dovecot-ca.cnf
+  echo 'default_days = 3650' >> /etc/ssl/dovecot-ca.cnf
+  echo 'default_md = sha256' >> /etc/ssl/dovecot-ca.cnf
+  echo 'default_bits = 2048' >> /etc/ssl/dovecot-ca.cnf
+  echo 'policy = dovecot-ca_policy' >> /etc/ssl/dovecot-ca.cnf
+  echo 'x509_extensions = dovecot-ca_extensions' >> /etc/ssl/dovecot-ca.cnf
+  echo '' >> /etc/ssl/dovecot-ca.cnf
+  echo '[ dovecot-ca_policy ]' >> /etc/ssl/dovecot-ca.cnf
+  echo 'commonName = supplied' >> /etc/ssl/dovecot-ca.cnf
+  echo 'stateOrProvinceName = supplied' >> /etc/ssl/dovecot-ca.cnf
+  echo 'countryName = supplied' >> /etc/ssl/dovecot-ca.cnf
+  echo 'emailAddress = optional' >> /etc/ssl/dovecot-ca.cnf
+  echo 'organizationName = supplied' >> /etc/ssl/dovecot-ca.cnf
+  echo 'organizationalUnitName = optional' >> /etc/ssl/dovecot-ca.cnf
+  echo '' >> /etc/ssl/dovecot-ca.cnf
+  echo '[ dovecot-ca_extensions ]' >> /etc/ssl/dovecot-ca.cnf
+  echo 'basicConstraints = CA:false' >> /etc/ssl/dovecot-ca.cnf
+  echo 'subjectKeyIdentifier = hash' >> /etc/ssl/dovecot-ca.cnf
+  echo 'authorityKeyIdentifier = keyid:always' >> /etc/ssl/dovecot-ca.cnf
+  echo 'keyUsage = digitalSignature,keyEncipherment' >> /etc/ssl/dovecot-ca.cnf
+  echo 'extendedKeyUsage = clientAuth' >> /etc/ssl/dovecot-ca.cnf
+  touch /etc/ssl/ssldb
+  echo 0001 > /etc/ssl/sslserial
+  freedombone-clientcert -u $MY_USERNAME
+  service dovecot restart
+  echo 'configure_imap_client_certs' >> $COMPLETION_FILE
+}
+
 function configure_gpg {
   if grep -Fxq "configure_gpg" $COMPLETION_FILE; then
       return
@@ -9153,6 +9199,7 @@ configure_email
 create_procmail
 spam_filtering
 configure_imap
+configure_imap_client_certs
 configure_gpg
 encrypt_incoming_email
 encrypt_outgoing_email
diff --git a/src/freedombone-clientcert b/src/freedombone-clientcert
new file mode 100755
index 0000000000000000000000000000000000000000..da65a21d54f4ee5d4ed9a99ae778f781a871658c
--- /dev/null
+++ b/src/freedombone-clientcert
@@ -0,0 +1,121 @@
+#!/bin/bash
+#
+# .---.                  .              .
+# |                      |              |
+# |--- .--. .-.  .-.  .-.|  .-. .--.--. |.-.  .-. .--.  .-.
+# |    |   (.-' (.-' (   | (   )|  |  | |   )(   )|  | (.-'
+# '    '     --'  --'  -' -  -' '  '   -' -'   -' '   -  --'
+#
+#                    Freedom in the Cloud
+#
+# Generates an email client cert for use with IMAP clients
+
+# See:
+#   http://strange.systems/certificate-based-auth-with-dovecot-sendmail
+#   http://help.fabasoftfolio.com/index.php?topic=doc/Installation-and-Configuration-of-Fabasoft-Folio-IMAP-Service/client-certificate-authentication.htm
+
+# License
+# =======
+#
+# Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+USERNAME=
+
+function show_help {
+    echo ''
+    echo 'freedombone-clientcert -u [username]'
+    echo ''
+    echo 'Creates email certificates for use with IMAP clients'
+    echo ''
+    echo '     --help                  Show help'
+    echo '  -u --username [name]       Username'
+    echo ''
+    exit 0
+}
+
+while [[ $# > 1 ]]
+do
+key="$1"
+
+case $key in
+    --help)
+    show_help
+    ;;
+    -u|--username)
+    shift
+    USERNAME="$1"
+    ;;
+    *)
+    # unknown option
+    ;;
+esac
+shift
+done
+
+if [ ! $USERNAME ]; then
+    echo 'No username specified'
+    exit 5748
+fi
+
+if [ ! -d /home/$USERNAME ]; then
+    echo "User $USERNAME not found"
+    exit 76239
+fi
+
+if [ -d /home/$USERNAME/emailcert ]; then
+    echo 'Client certs were already for created'
+    exit 2953
+fi
+
+if [ ! -f /etc/dovecot/passwd-file ]; then
+    touch /etc/dovecot/passwd-file
+fi
+
+# Add a user password
+if ! grep -q "$USERNAME:{plain}" $/etc/dovecot/passwd-file; then
+  echo "$USERNAME:{plain}::::::nopassword" >> /etc/dovecot/passwd-file
+fi
+
+chmod 600 /etc/dovecot/passwd-file
+
+# create a user cert
+freedombone-addcert -h $USERNAME
+
+# create a certificate request
+openssl req -new -sha256 -key /etc/ssl/private/$USERNAME.key -out /etc/ssl/requests/$USERNAME.csr
+
+# sign the certificate request
+openssl ca -config /etc/ssl/dovecot-ca.cnf -in /etc/ssl/requests/$USERNAME.csr -out /etc/ssl/certs/$USERNAME.cer
+
+# move the cert to the user's home
+mkdir /home/$USERNAME/emailcert
+mv /etc/ssl/certs/$USERNAME.cer /home/$USERNAME/emailcert
+cp /etc/ssl/certs/dovecot-ca.crt /home/$USERNAME/emailcert
+mv /etc/ssl/private/$USERNAME.key /home/$USERNAME/emailcert
+mv /etc/ssl/certs/$USERNAME.crt /home/$USERNAME/emailcert
+
+# set permissions for the user
+chmod -R 600 /home/$USERNAME/emailcert
+chown -R $USERNAME:$USERNAME /home/$USERNAME/emailcert
+
+shred -zu /etc/ssl/requests/$USERNAME.csr
+
+echo 'Email authentication certificate created. You can obtain it on the client with:'
+echo ''
+echo "      scp -P 2222 -r $USERNAME@mydomainname:/home/$USERNAME/emailcert ~/"
+echo ''
+
+exit 0