totemomail migration: new operating system or Kiteworks EPG

totemomail installations often run for many years and carry a rule set that has grown over time, key material from several certificate generations and WebMail accounts of external recipients. Whether the existing installation moves to a new, supported operating system base or the move to the Kiteworks Email Protection Gateway is due: we plan and support both routes, with acceptance tests that also cover historical messages.

totemomail
Kiteworks EPG
OS Migration
S/MIME & OpenPGP
WebMail
Apache James

Get in touch →

Two migration routes

In an OS migration, totemomail remains the product; what gets replaced is the base underneath. Configuration, database, keystores, certificates and licence move to a new system, node by node and with a way back. When moving to Kiteworks EPG, the platform changes: Kiteworks transfers the data from the totemomail database to the database of the Hardened Virtual Appliance in an automated process. Rules, integrations and operating procedures, however, have to be checked against the new platform and in part rebuilt.

Services

Inventory Inventorying rules, triggers, priorities, domains, connectors, keys and the licence metric; cleaning up unused rules and expired certificates before the migration.

OS migration Building the new system, carrying over configuration, database and keystores, switching cluster nodes one at a time and shutting down the old node only after acceptance.

Move to Kiteworks EPG Defining the migration scope, preparing and verifying the data transfer, mapping the rule set and integrations such as directory, SIEM and archive to EPG.

Routing and Microsoft 365 Switching connectors in Exchange Online or Exchange Server, MX, TLS requirements and allowlists to the new gateway, without a delivery gap.

How an engagement runs

1 Inventory and clean-up What is actively used is carried over; what nobody needs any more stays behind.
2 Parallel build The new system runs in parallel and is tested with test domains and test recipients before production traffic is switched over.
3 Cutover Switching routes one at a time and reversibly, closely monitoring mail flow and queues.
4 Acceptance and decommissioning Testing new and historical messages for each encryption type, then removing the old system from DNS, connectors, allowlists and monitoring.

From comparable projects

Health insurer 6 servers in the cluster Secure messaging platform: in-place upgrade of totemomail

17 Jun 2026 · TotemoMail Understanding Mail Routing Between TotemoMail and Exchange Online How TotemoMail stores and processes messages, how the underlying Apache James switches between processors, and what matters for a secure mail loop with Exchange Online. 11 Aug 2026 · Totemomail Rebuilding Apache James Rule Sets in a Structured Way: Tools and Method Mailet rule sets that have grown over the years contain dead paths that no one recognizes anymore. Learn how to analyze the rule set as a graph, reliably find unreachable code, and design the migration so that a single Mailet keeps the rollback path open. 6 Oct 2026 · Totemomail Renewing a Totemomail Certificate: 4096-Bit Key, PKCS#12 Import, and Restarting Each Node Totemomail’s request dialog generates only 2048-bit keys without alternative names. However, many internal CAs now sign only 4096-bit keys. The key and request are therefore created with openssl, followed by ordering from the PKI team, PKCS#12 import, connector binding, and restarting each node.

Planning something similar?

In a first conversation, we'll look at where you stand, the risks and the most sensible next step.