====== MailCleaner LetsEncrypt Free SSL ======

FIXME Unfinished automated renewals

https://letsencrypt.org/

===== Install certbot =====

:!: MailCleaner may use a very old Debian base OS that has no ''certbot'' package.

<file>
wget https://dl.eff.org/certbot-auto
mv certbot-auto /usr/local/bin/certbot-auto
chown root /usr/local/bin/certbot-auto
chmod 0755 /usr/local/bin/certbot-auto
</file>

===== Single Server =====

**Follow this howto**: https://opensource.com/article/20/6/secure-open-source-antispam

===== MailCleaner Cluster =====

<note important>MailCleaner clusters treat SSL certificates as a **cluster resource** synchronized to all cluster servers.  This means **you need a wildcard SSL certificate** for a MailCleaner cluster.</note>

<note warning>LetsEncrypt wildcard SSL certificates require you use a **DNS-01 challenge**.</note>

https://letsencrypt.org/docs/challenge-types/

==== DNS-01 Howto ====

=== Scripts ===

You will need to create a couple of scripts.

The ''set-certificate.pl'' script is used to **apply the LE cert after it is acquired**.

<file>
wget https://gist.github.com/victorlclopes/f5aa081f1a9c76466aaf3f3dc5bd60b7/raw/c97a1400bb30e4439622b089f146b8cb8dc886b7/set-certificate.pl -O /usr/local/bin/set-certificate.pl
chmod +x /usr/local/bin/set-certificate.pl
</file>

FIXME The ''deploylecert.sh'' script is **not used** here as only **manual renewal** is shown.

The ''deploylecert.sh'' script **must be edited** and is called from ''cron'' during certificate renewals.  It just calls the generic ''set-certificate.pl'' script with your details.

<file>
cat << EOF > /usr/local/bin/deploylecert.sh
#!/bin/sh
#
/usr/local/bin/set-certificate.pl --set_web --set_mta_in --set_mta_out \
 --key /etc/letsencrypt/live/yourtopleveldomain.tld/privkey.pem \
 --data /etc/letsencrypt/live/yourtopleveldomain.tld/cert.pem \
 --chain /etc/letsencrypt/live/yourtopleveldomain.tld/chain.pem
EOF
chmod +x /usr/local/bin/deploylecert.sh
</file>

=== Get the Certificate ===

<note important>We must use the ''manual'' plugin and the ''DNS-01'' challenge for a LetsEncrypt wildcard certificate.</note>

Use **staging** servers for testing without limits:

<file>
certbot-auto certonly --manual --preferred-challenges dns \
 --email you@youremailaddress.tld --no-eff-email --agree-tos --staging \
 --debug-challenges -d \*.yourtopleveldomain.tld -d yourtopleveldomain.tld
</file>
 
Use **primary** servers (not staging) to get the **actual cert**:
 
<file>
certbot-auto certonly --manual --preferred-challenges dns \
 --email you@youremailaddress.tld --no-eff-email --agree-tos \
 --debug-challenges -d \*.yourtopleveldomain.tld -d yourtopleveldomain.tld \
 --pre-hook "/usr/mailcleaner/etc/init.d/apache stop" \
 --post-hook "/usr/mailcleaner/etc/init.d/apache start"
</file>

<note important>You will have to add a DNS TXT record for each domain specified, two in this case.  Wait for enough time for your DNS TXT records to propagate to all your DNS servers.  I'd wait a full minute or more before continuing. YMMV</note>

=== List the Certificate ===

<file>
ls /etc/letsencrypt/live/yourtopleveldomain.tld/
</file>

=== Install the Certificate ===

This command installs the new cert for MailCleaner (HTTPS and SMTP STARTTLS):

<file>
/usr/local/bin/set-certificate.pl --set_web --set_mta_in --set_mta_out \
 --key /etc/letsencrypt/live/yourtopleveldomain.tld/privkey.pem \
 --data /etc/letsencrypt/live/yourtopleveldomain.tld/cert.pem \
 --chain /etc/letsencrypt/live/yourtopleveldomain.tld/chain.pem
</file>

==== Renew the Certificate Manually ====

<note warning>We don't use the ''certbot'' renew function because it doesn't work with DNS-01 (manual).</note>

<note warning>We must either renew manually, adding a new ''_acme-challenge'' TXT record each time, or use a DNS provider with a supported API (not shown here).</note>

<note warning>Use **exactly the same domain names** as when the original cert was created or another cert will be created instead of renewing the existing one.</note>

<note important>You will have to **add** (not replace) a DNS TXT record for each domain and SAN specified, two in this case.  Wait for enough time for your DNS TXT records to propagate to all your DNS servers.  I'd wait a full minute or more before continuing.</note>

^ --keep          |will not renew the cert until it has 30 days or less to expire (i.e. after 60 days) |
^ --force-renewal |will force the renewal and is subject to rate limitations                           |

Check and renew cert if it has less than 30 days until expiry:

<file>
/usr/local/bin/certbot-auto certonly --manual --keep --manual-public-ip-logging-ok --preferred-challenges=dns -d 'yourtopleveldomain.tld,*.yourtopleveldomain.tld' --deploy-hook /usr/local/bin/deploylecert.sh
</file>

Force cert renewal:

<file>
/usr/local/bin/certbot-auto certonly --manual --force-renewal --manual-public-ip-logging-ok --preferred-challenges=dns -d 'yourtopleveldomain.tld,*.yourtopleveldomain.tld' --deploy-hook /usr/local/bin/deploylecert.sh
</file>

===== Sync SSL Cert to MailCleaner Slaves =====

Once the cert is installed and tested on the master MailCleaner server, sync the SSL cert to the MailCleaner slaves.  **Do this at the slave**.  This command runs nightly anyway, so if your current cert has not expired, you can omit this step for now.

<file>
/root/Updater4MC/updater4mc.sh
</file>

===== Testing =====

Test the HTTPS cert from most any Linux machine:

<file>
openssl s_client -connect mailcleanermaster.yourtopleveldomain.tld:443 -servername mailcleanermaster.yourtopleveldomain.tld < /dev/null
</file>

Test the inbound SMTP cert:

<file>
openssl s_client -connect mailcleanermaster.yourtopleveldomain.tld:25 -starttls smtp < /dev/null
</file>

Show dates:

<file>
openssl s_client -connect mailcleanermaster.yourtopleveldomain.tld:25 -starttls smtp < /dev/null | openssl x509 -noout -dates
</file>

===== Helpful Commands =====

See also **[[https://certbot.eff.org/docs/using.html|certbot User Guide]]**

List LE certificates:

<file>
certbot-auto certificates
</file>

Delete a cert you don't need:

<file>
certbot delete --cert-name certname.yourtopleveldomain.tld
</file>