Let's Encrypt is a free, automated and open certificate authority. The CA issues standard domain validation certificates. The certificates can be used for web servers, email servers, FTP servers and many more. Email encryption and code signing requires a different type of certificate that Let's encrypt doesn't issue.
Below are a few links that you might want to read:
You can find the documentation here:
https://letsencrypt.org/docs/
Important: What you need to know about TLS-SNI validation issues
https://community.letsencrypt.org/t...to-know-about-tls-sni-validation-issues/50811
For Let's Encrypt and DNS CAA records read this document:
https://letsencrypt.org/docs/caa/
If you don't care about CAA, you don't have to do anything but in case of errors check the CAA error section
in the document above.
If you would like to use CAA records, check out the CAA generator of:
https://sslmate.com/caa/
Proxmox Mail Gateway uses Keys and certificate to make secure connections. The application uses the keys and certificates stored at:
/etc/pmg/pmg-api.pem -- Key and certificate (combined) used be the HTTPs server (API)
/etc/pmg/pmg-tls.pem -- Key and certificate (combined) to encrypt mail traffic (TLS)
Be aware, that the application itself can overwrite some key and certificate files, e.g. when you disable & enable the TLS settings in the mail proxy configuration.
To replace the TLS certificates we request certificates from the Let's encrypt CA. We do that with the certbot application.
Preconditions
Firewall http/inbound is open.
Hostname is properly set
PMG Mail Proxy configuration has enabled TLS and TLS logging
Installation
It is recommended to use the certbot application from the stretch-backports repository. To install files from stretch-backports add the repository to your sources.list:
# vi /etc/apt/sources.list
Add the line
deb http://ftp.debian.org/debian stretch-backports main
After you edited the file run:
# apt-get update
To install certbot run:
# apt-get install certbot -t stretch-backports
Before we request the certificate we create a post-hook script in our /root directory.
# cd /root
# vi certbot-post-hook.sh
Set access permissions to your post-hook script:
# chmod 700 certbot-post-hook.sh
Now you can request the certificate:
# certbot certonly --authenticator standalone --preferred-challenges http --post-hook "/root/certbot-post-hook.sh" -d $(hostname -f)
Enter your email address, agree to the terms of service and answer the question if you would like to share your email address.
Congratulations you have requested and installed (via post-hook) your Let's encrypt certificate.
Automated renewal
The debian package comes with a cron job and a systemd timer.
The cron job won't execute the renew command when you are running systemd (if /run/systemd/system is detected). It's done via certbot.timer
For automatic renewal just make sure certbot.timer is enabled & started. Post-Hook and Preferred Challenges were stored in /etc/letsencrypt/renewal/($hostname -f).conf during certificate request.
# systemctl status certbot.timer
Status should be enabled/active (waiting).
Check your certificate in the browser and watch the TLS log output in /var/log/mail.log.
Verify your mail server tls encryption here: https://ssl-tools.net/mailservers
Below are a few links that you might want to read:
You can find the documentation here:
https://letsencrypt.org/docs/
Important: What you need to know about TLS-SNI validation issues
https://community.letsencrypt.org/t...to-know-about-tls-sni-validation-issues/50811
For Let's Encrypt and DNS CAA records read this document:
https://letsencrypt.org/docs/caa/
If you don't care about CAA, you don't have to do anything but in case of errors check the CAA error section
in the document above.
If you would like to use CAA records, check out the CAA generator of:
https://sslmate.com/caa/
Proxmox Mail Gateway uses Keys and certificate to make secure connections. The application uses the keys and certificates stored at:
/etc/pmg/pmg-api.pem -- Key and certificate (combined) used be the HTTPs server (API)
/etc/pmg/pmg-tls.pem -- Key and certificate (combined) to encrypt mail traffic (TLS)
Be aware, that the application itself can overwrite some key and certificate files, e.g. when you disable & enable the TLS settings in the mail proxy configuration.
To replace the TLS certificates we request certificates from the Let's encrypt CA. We do that with the certbot application.
Preconditions
Firewall http/inbound is open.
Hostname is properly set
PMG Mail Proxy configuration has enabled TLS and TLS logging
Installation
It is recommended to use the certbot application from the stretch-backports repository. To install files from stretch-backports add the repository to your sources.list:
# vi /etc/apt/sources.list
Add the line
deb http://ftp.debian.org/debian stretch-backports main
After you edited the file run:
# apt-get update
To install certbot run:
# apt-get install certbot -t stretch-backports
Before we request the certificate we create a post-hook script in our /root directory.
# cd /root
# vi certbot-post-hook.sh
Code:
#!/bin/bash
# post-hook see renewalparams in /etc/letsencrypt/renewal/$(hostname -f).conf
# replace mail certificate
cat /etc/letsencrypt/live/$(hostname -f)/fullchain.pem /etc/letsencrypt/live/$(hostname -f)/privkey.pem >/etc/pmg/pmg-tls.pem
chown root:root /etc/pmg/pmg-tls.pem
chmod 600 /etc/pmg/pmg-tls.pem
# replace http certificate
cat /etc/letsencrypt/live/$(hostname -f)/fullchain.pem /etc/letsencrypt/live/$(hostname -f)/privkey.pem >/etc/pmg/pmg-api.pem
chown root:www-data /etc/pmg/pmg-api.pem
chmod 640 /etc/pmg/pmg-api.pem
systemctl restart pmgproxySet access permissions to your post-hook script:
# chmod 700 certbot-post-hook.sh
Now you can request the certificate:
# certbot certonly --authenticator standalone --preferred-challenges http --post-hook "/root/certbot-post-hook.sh" -d $(hostname -f)
Enter your email address, agree to the terms of service and answer the question if you would like to share your email address.
Congratulations you have requested and installed (via post-hook) your Let's encrypt certificate.
Automated renewal
The debian package comes with a cron job and a systemd timer.
The cron job won't execute the renew command when you are running systemd (if /run/systemd/system is detected). It's done via certbot.timer
For automatic renewal just make sure certbot.timer is enabled & started. Post-Hook and Preferred Challenges were stored in /etc/letsencrypt/renewal/($hostname -f).conf during certificate request.
# systemctl status certbot.timer
Status should be enabled/active (waiting).
Check your certificate in the browser and watch the TLS log output in /var/log/mail.log.
Verify your mail server tls encryption here: https://ssl-tools.net/mailservers
Last edited:
