User Tools
Table of Contents
MailCleaner LetsEncrypt Free SSL
Unfinished automated renewals
Install certbot
MailCleaner may use a very old Debian base OS that has no certbot package.
wget https://dl.eff.org/certbot-auto mv certbot-auto /usr/local/bin/certbot-auto chown root /usr/local/bin/certbot-auto chmod 0755 /usr/local/bin/certbot-auto
Single Server
Follow this howto: https://opensource.com/article/20/6/secure-open-source-antispam
MailCleaner Cluster
DNS-01 Howto
Scripts
You will need to create a couple of scripts.
The set-certificate.pl script is used to apply the LE cert after it is acquired.
wget https://gist.github.com/victorlclopes/f5aa081f1a9c76466aaf3f3dc5bd60b7/raw/c97a1400bb30e4439622b089f146b8cb8dc886b7/set-certificate.pl -O /usr/local/bin/set-certificate.pl chmod +x /usr/local/bin/set-certificate.pl
The deploylecert.sh script is not used here as only manual renewal is shown.
The deploylecert.sh script must be edited and is called from cron during certificate renewals. It just calls the generic set-certificate.pl script with your details.
cat << EOF > /usr/local/bin/deploylecert.sh #!/bin/sh # /usr/local/bin/set-certificate.pl --set_web --set_mta_in --set_mta_out \ --key /etc/letsencrypt/live/yourtopleveldomain.tld/privkey.pem \ --data /etc/letsencrypt/live/yourtopleveldomain.tld/cert.pem \ --chain /etc/letsencrypt/live/yourtopleveldomain.tld/chain.pem EOF chmod +x /usr/local/bin/deploylecert.sh
Get the Certificate
manual plugin and the DNS-01 challenge for a LetsEncrypt wildcard certificate.
Use staging servers for testing without limits:
certbot-auto certonly --manual --preferred-challenges dns \ --email you@youremailaddress.tld --no-eff-email --agree-tos --staging \ --debug-challenges -d \*.yourtopleveldomain.tld -d yourtopleveldomain.tld
Use primary servers (not staging) to get the actual cert:
certbot-auto certonly --manual --preferred-challenges dns \ --email you@youremailaddress.tld --no-eff-email --agree-tos \ --debug-challenges -d \*.yourtopleveldomain.tld -d yourtopleveldomain.tld \ --pre-hook "/usr/mailcleaner/etc/init.d/apache stop" \ --post-hook "/usr/mailcleaner/etc/init.d/apache start"
List the Certificate
ls /etc/letsencrypt/live/yourtopleveldomain.tld/
Install the Certificate
This command installs the new cert for MailCleaner (HTTPS and SMTP STARTTLS):
/usr/local/bin/set-certificate.pl --set_web --set_mta_in --set_mta_out \ --key /etc/letsencrypt/live/yourtopleveldomain.tld/privkey.pem \ --data /etc/letsencrypt/live/yourtopleveldomain.tld/cert.pem \ --chain /etc/letsencrypt/live/yourtopleveldomain.tld/chain.pem
Renew the Certificate Manually
certbot renew function because it doesn't work with DNS-01 (manual).
_acme-challenge TXT record each time, or use a DNS provider with a supported API (not shown here).
| –keep | will not renew the cert until it has 30 days or less to expire (i.e. after 60 days) |
|---|---|
| –force-renewal | will force the renewal and is subject to rate limitations |
Check and renew cert if it has less than 30 days until expiry:
/usr/local/bin/certbot-auto certonly --manual --keep --manual-public-ip-logging-ok --preferred-challenges=dns -d 'yourtopleveldomain.tld,*.yourtopleveldomain.tld' --deploy-hook /usr/local/bin/deploylecert.sh
Force cert renewal:
/usr/local/bin/certbot-auto certonly --manual --force-renewal --manual-public-ip-logging-ok --preferred-challenges=dns -d 'yourtopleveldomain.tld,*.yourtopleveldomain.tld' --deploy-hook /usr/local/bin/deploylecert.sh
Sync SSL Cert to MailCleaner Slaves
Once the cert is installed and tested on the master MailCleaner server, sync the SSL cert to the MailCleaner slaves. Do this at the slave. This command runs nightly anyway, so if your current cert has not expired, you can omit this step for now.
/root/Updater4MC/updater4mc.sh
Testing
Test the HTTPS cert from most any Linux machine:
openssl s_client -connect mailcleanermaster.yourtopleveldomain.tld:443 -servername mailcleanermaster.yourtopleveldomain.tld < /dev/null
Test the inbound SMTP cert:
openssl s_client -connect mailcleanermaster.yourtopleveldomain.tld:25 -starttls smtp < /dev/null
Show dates:
openssl s_client -connect mailcleanermaster.yourtopleveldomain.tld:25 -starttls smtp < /dev/null | openssl x509 -noout -dates
Helpful Commands
See also certbot User Guide
List LE certificates:
certbot-auto certificates
Delete a cert you don't need:
certbot delete --cert-name certname.yourtopleveldomain.tld
