Contents
1.Obtain an SSL certificate ( Let's Encrypt )
Install the latest open ssl
|
1 |
# dnf install openssl-devel |
1.1 advance preparation
1.Package management system Snappy installed
Since the SSL certificate issuing tool "certbot" of Let's Encrypt is recommended to be installed using "snap" after 2021, install Snapd first.(Can also be installed the traditional way with dnf or yum)
|
1 2 3 |
# dnf install epel-release # dnf upgrade # dnf install snapd |
Enable systemd unit to manage the main snap communication socket
|
1 2 |
# systemctl enable --now snapd.socket Created symlink /etc/systemd/system/sockets.target.wants/snapd.socket → /usr/lib/systemd/system/snapd.socket. |
Enable Classics Snap support
|
1 |
# ln -s /var/lib/snapd/snap /snap |
Version Check
|
1 2 3 4 5 6 |
# snap --version snap 2.68.3-0.el9 snapd 2.68.3-0.el9 series 16 miraclelinux 9.6 kernel 5.14.0-570.17.1.el9_6.x86_64 |
Log out and log in again or reboot the system to ensure that the snap path is updated correctly
2.certbot package install
|
1 2 |
# snap install --classic certbot certbot 4.1.1 from Certbot Project (certbot-eff✓) installed |
Create symbolic link to /snap/bin/certbot
|
1 |
# ln -s /snap/bin/certbot /usr/bin/certbot |
Confirmation
|
1 2 3 4 5 |
# ls -la /usr/bin/certbot lrwxrwxrwx 1 root root 17 Sep 10 17:35 /usr/bin/certbot -> /snap/bin/certbot # ls -la /snap/bin/certbot lrwxrwxrwx 1 root root 13 Sep 10 17:34 /snap/bin/certbot -> /usr/bin/snap |
1.2 Obtaining Certificates
|
1 |
# certbot certonly --webroot -w /var/www/html/[FQDN] -d [FQDN] |
Registration of e-mail address and agreement to terms of use are required for the first time only.
Specify an email address to receive
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address or hit Enter to skip.
(Enter 'c' to cancel): [E-mail address]
------------------------------------------------------------------------------------------------------------
Please read the Terms of Service at:
https://letsencrypt.org/documents/LE-SA-v1.5-February-24-2025.pdf
You must agree in order to register with the ACME server. Do you agree?
-----------------------------------------------------------------------------------------------------------
(Y)es/(N)o: y
-----------------------------------------------------------------------------------------------------------
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
-----------------------------------------------------------------------------------------------------------
(Y)es/(N)o: y
Account registered.
Requesting a certificate for [FQDN]
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/ [FQDN]/fullchain.pem
Key is saved at: /etc/letsencrypt/live/ [FQDN]/privkey.pem
This certificate expires on 2025-10-15.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
---------------------------------------------------------------------------------------------------------
If you like Certbot, please consider supporting our work by:
*Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
*Donating to EFF: https://eff.org/donate-le
---------------------------------------------------------------------------------------------------------
Success if displayed"Successfully received certificate".
The following certificate is obtained under [/etc/letsencrypt/live/<FQDN>/] as described in the message
cert.pem ⇒ SSL server certificate (including public key)
chain.pem ⇒ intermediate certificate
fullchain.pem ⇒ File containing cert.pem and chain.pem combined
privkey.pem ⇒ private key
Renewing certificates already obtained
# Renew all certificates with an expiration date of less than 30 days
# If you want to renew regardless of the number of days remaining on the expiration date, specify [--force-renewal] as well.
# certbot --force-renewal renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log
---------------------------------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/[FQDN].conf
---------------------------------------------------------------------------------------------------------
Renewing an existing certificate for [FQDN]
---------------------------------------------------------------------------------------------------------
Congratulations, all renewals succeeded:
/etc/letsencrypt/live/[FQDN]/fullchain.pem (success)
1.2 Automatic renewal of certificates(Let's Encrypt)
①Pre-registration testing
First, test the automatic update using the following --dry-run option.
With this option, certificates are not renewed, only checked, so there is no need to worry about getting stuck with a limit on the number of times a certificate can be obtained.
|
1 |
# certbot renew --dry-run |
Saving debug log to /var/log/letsencrypt/letsencrypt.log
---------------------------------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/[FQDN].conf
---------------------------------------------------------------------------------------------------------
Account registered.
Simulating renewal of an existing certificate for [FQDN]
---------------------------------------------------------------------------------------------------------
Congratulations, all simulated renewals succeeded:
/etc/letsencrypt/live/[FQDN]/fullchain.pem (success)
②When you install the snap version of certbot, the automatic certificate renewal function is also installed.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
# systemctl list-timers | less NEXT LEFT LAST PASSED UNIT ACTIVATES Thu 2025-07-17 15:10:00 JST 5min left Thu 2025-07-17 15:00:01 JST 4min 9s ago sysstat-collect.timer sysstat-collect.service Thu 2025-07-17 15:25:00 JST 20min left Thu 2025-07-17 14:55:01 JST 9min ago pmlogger_check.timer pmlogger_check.service Thu 2025-07-17 15:25:10 JST 20min left Thu 2025-07-17 14:55:14 JST 8min ago pmlogger_farm_check.timer pmlogger_farm_check.service Thu 2025-07-17 15:25:52 JST 21min left - - dnf-makecache.timer dnf-makecache.service Thu 2025-07-17 15:28:00 JST 23min left Thu 2025-07-17 14:58:05 JST 6min ago pmie_check.timer pmie_check.service Thu 2025-07-17 15:28:10 JST 23min left Thu 2025-07-17 14:58:14 JST 5min ago pmie_farm_check.timer pmie_farm_check.service Thu 2025-07-17 18:08:00 JST 3h 3min left - - snap.certbot.renew.timer snap.certbot.renew.service Fri 2025-07-18 00:00:00 JST 8h left Thu 2025-07-17 08:30:12 JST 6h ago logrotate.timer logrotate.service Fri 2025-07-18 00:00:00 JST 8h left Thu 2025-07-17 08:30:12 JST 6h ago mlocate-updatedb.timer mlocate-updatedb.service Fri 2025-07-18 00:00:00 JST 8h left - - sa-update.timer sa-update.service Fri 2025-07-18 00:07:00 JST 9h left - - sysstat-summary.timer sysstat-summary.service Fri 2025-07-18 00:08:00 JST 9h left Thu 2025-07-17 08:30:15 JST 6h ago pmie_daily.timer pmie_daily.service Fri 2025-07-18 00:10:00 JST 9h left Thu 2025-07-17 08:30:15 JST 6h ago pmlogger_daily.timer pmlogger_daily.service Fri 2025-07-18 14:53:54 JST 23h left Thu 2025-07-17 14:53:54 JST 10min ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service 14 timers listed. Pass --all to see loaded but inactive timers, too. |
snap.certbot.renew.timer is registered
Check the unit file snap.certbot.renew.timer
|
1 |
# vi /etc/systemd/system/timers.target.wants/snap.certbot.renew.timer |
#Auto-generated, DO NOT EDIT
Description=Timer renew for snap application certbot.renew
Requires=var-lib-snapd-snap-certbot-4737.mount
After=var-lib-snapd-snap-certbot-4737.mount
X-Snappy=yes
Unit=snap.certbot.renew.service
OnCalendar=--* 06:07
OnCalendar=--* 18:08 [Install]
WantedBy=timers.target
According to the above configuration, it will attempt to update at 06:07 and 18:08 every day as specified in the OnCalender parameter(However, the set time changes randomly with each update)
Check the unit file snap.certbot.renew.service
|
1 |
# vi /etc/systemd/system/snap.certbot.renew.service |
#Auto-generated, DO NOT EDIT
Description=Service for snap application certbot.renew
Requires=var-lib-snapd-snap-certbot-4737.mount
Wants=network.target
After=var-lib-snapd-snap-certbot-4737.mount network.target snapd.apparmor.service
X-Snappy=yes
EnvironmentFile=-/etc/environment
ExecStart=/usr/bin/snap run --timer="00:00~24:00/2" certbot.renew
SyslogIdentifier=certbot.renew
Restart=no
WorkingDirectory=/var/snap/certbot/4737
TimeoutStopSec=30
Type=oneshot
However, the web server using the certificate will not be restarted, so set up a script to run automatically after the update
|
1 2 3 4 |
# vi /etc/letsencrypt/renewal-hooks/post/web_restart.sh Describe the following #!/bin/bash systemctl reload httpd |
|
1 |
# chmod 755 /etc/letsencrypt/renewal-hooks/post/web_restart.sh |
2. Converting Apache to https
Install the following just in case
|
1 |
# dnf -y install mod_ssl |
2.1 Edit ssl.conf file
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
# vi /etc/httpd/conf.d/ssl.conf Line 43 : Uncomment and change DocumentRoot "/var/www/html/<FQDN>" Line 44 : Uncomment and change ServerName [FQDN]:443 Line 85 : Make it a comment and add it below # SSLCertificateFile /etc/pki/tls/certs/localhost.crt SSLCertificateFile /etc/letsencrypt/live/[FQDN]/cert.pem Line 93 : Make it a comment and add it below # SSLCertificateKeyFile /etc/pki/tls/private/localhost.key SSLCertificateKeyFile /etc/letsencrypt/live/[FQDN]/privkey.pem Line 103 : Add SSLCertificateChainFile /etc/letsencrypt/live/[FQDN]/chain.pem |
Restart Apache.
|
1 |
# systemctl restart httpd |
Allow https in Firewall
|
1 2 3 4 |
# firewall-cmd --add-service=https --permanent success # firewall-cmd --reload success |
2.2 Redirect HTTP communications to HTTPS
Add to virtual host configuration file
|
1 |
# vi /etc/httpd/conf.d/vhost.conf |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
<VirtualHost *:80> DocumentRoot /var/www/html/miracle.korodes.com ServerName miracle.korodes.com ServerAdmin mhori@hera.eonet.ne.jp ErrorLog logs/miracle.korodes.com.error_log CustomLog logs/miracle.korodes.com.access_log combined #Add the following 3 lines RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] </VirtualHost> <Directory "/var/www/html/miracle.korodes.com"> Options FollowSymLinks AllowOverride All </Directory> |
Apache restart
|
1 |
# systemctl restart httpd |
3. SSL/TLS (Let's Encrypt) settings on the mail server
3.1 Obtaining a certificate for the mail server
Obtain a certificate for the mail server, but it cannot be obtained in the same way as above, so the following with the "--standalone" option fails.
|
1 |
# certbot certonly --standalone -d mail.[domain name] |
If I stop the web server once and then do it, it succeeds as follows
|
1 2 |
# systemctl stop httpd.service # certbot certonly --standalone -d mail.[domain name] |
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for mail.[Domain]
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/mail.[Domain]/fullchain.pem
Key is saved at: /etc/letsencrypt/live/mail.[Domain]/privkey.pem
This certificate expires on 2025-10-15.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
----------------------------------------------------------------------------------------------------------
If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
----------------------------------------------------------------------------------------------------------
Apache restart
|
1 |
# systemctl restart httpd |
3.2 Postfix Configuration
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
# vi /etc/postfix/main.cf Per lines 709, 715 : comment #smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem #smtpd_tls_key_file = /etc/pki/tls/private/postfix.key Add to the last line smtpd_use_tls = yes smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_cert_file = /etc/letsencrypt/live/mail.[domain name]/fullchain.pem smtpd_tls_key_file = /etc/letsencrypt/live/mail.[domain name]/privkey.pem smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
# vi /etc/postfix/master.cf Line 17-20 : Uncomment submission inet n - n - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes Line 29-32 : Uncomment smtps inet n - n - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes |
3.3 Dovecot Settings
|
1 2 3 4 5 6 7 8 9 10 |
# vi /etc/dovecot/conf.d/10-ssl.conf Line 9：confirmation ssl = yes Line 14,15：Make it a comment and add certificate/key file designation under it #ssl_cert = </etc/pki/dovecot/certs/dovecot.pem #ssl_key = </etc/pki/dovecot/private/dovecot.pem ssl_cert = </etc/letsencrypt/live/mail.[domain name]/fullchain.pem ssl_key = </etc/letsencrypt/live/mail.[domain name]/privkey.pem |
Allow Port 587 in firewall
|
1 2 |
# firewall-cmd --add-port=587/tcp --permanent # firewall-cmd --reload |
restart
|
1 |
# systemctl restart postfix dovecot |
3.4 Thunderbird Settings
Receiving servers
Port : 143
Connection security : STARTTLS
Authentication method : Normal password
Sending server
Port : 587
Connection security : STARTTLS
Authentication method : Normal password
