diff --git a/CHANGELOG.md b/CHANGELOG.md
index 639c7e13..f73fe3b5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,7 @@ The **patch** part changes incrementally at each release.
 * minifirewall: improve variables values and documentation
 
 ### Changed
+* dovecot: enable SSL/TLS by default with snakeoil certificate
 
 ### Fixed
 
diff --git a/dovecot/templates/z-evolinux-defaults.conf.j2 b/dovecot/templates/z-evolinux-defaults.conf.j2
index b6d8d5e5..787b9d01 100644
--- a/dovecot/templates/z-evolinux-defaults.conf.j2
+++ b/dovecot/templates/z-evolinux-defaults.conf.j2
@@ -34,3 +34,8 @@ service login {
     process_limit = 256
 }
 mail_max_userip_connections = 42
+
+# SSL/TLS
+ssl = yes
+ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem
+ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key