1.Package management system Snappy installed Since the SSL certificate issuing tool "certbot" of Let's Encrypt is recommended to be installed using "snap" after 2021, install Snapd first.(Can also be installed the traditional way with dnf or yum)
You must agree in
order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
Account registered.
Requesting a certificate for [FQDN]
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/[FQDN]/fullchain.pem
Key is saved at: /etc/letsencrypt/live/[FQDN]/privkey.pem
This certificate expires on 2026-09-06.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
We were unable to subscribe you the EFF mailing list because your e-mail address appears to be invalid. You can try again later by visiting https://act.eff.org.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Success if displayed"Successfully received certificate". # The following certificate is obtained under [/etc/letsencrypt/live/<FQDN>/] as described in the message ・cert.pem ⇒ SSL server certificate (including public key) ・chain.pem ⇒ intermediate certificate ・fullchain.pem ⇒ File containing cert.pem and chain.pem combined ・privkey.pem ⇒ private key
※Obtaining a Let's Encrypt certificate when the web server is not running
It is a prerequisite that the server on which the work is to be performed is accessible from the Internet at port 80. ・Use the simple Web server function by specifying [--standalone]. ・-d [FQDN from which you want to obtain a certificate]. # FQDN (Fully Qualified Domain Name) :Hostname. Domain name without abbreviation ・If there are multiple FQDNs for which you want to obtain certificates, specify multiple -d [FQDNs] for which you want to obtain certificates
# certbot certonly --standalone -d <FQDN>
Renewing certificates already obtained ・ Renew all certificates with an expiration date of less than 30 days ・ If you want to renew regardless of the number of days remaining on the expiration date, specify [--force-renewal] as well.
# certbot [--force-renewal] renew
1.2 Automatic renewal of certificates(Let's Encrypt)
①Pre-registration testing First, test the automatic update using the following --dry-run option. With this option, certificates are not renewed, only checked, so there is no need to worry about getting stuck with a limit on the number of times a certificate can be obtained.
②When you install the snap version of certbot, the automatic certificate renewal function is also installed.
# systemctl list-timers | less
NEXT LEFT LAST PASSED UNIT ACTIVATES
Mon 2026-06-08 14:28:00 JST 1min 18s left Mon 2026-06-08 13:58:04 JST 28min ago pmie_check.timer pmie_check.service
Mon 2026-06-08 14:28:10 JST 1min 28s left Mon 2026-06-08 13:58:12 JST 28min ago pmie_farm_check.timer pmie_farm_check.service
Mon 2026-06-08 14:30:00 JST 3min 18s left Mon 2026-06-08 14:20:04 JST 6min ago sysstat-collect.timer sysstat-collect.service
Mon 2026-06-08 14:55:00 JST 28min left Mon 2026-06-08 14:25:03 JST 1min 38s ago pmlogger_check.timer pmlogger_check.service
Mon 2026-06-08 14:55:10 JST 28min left Mon 2026-06-08 14:25:12 JST 1min 29s ago pmlogger_farm_check.timer pmlogger_farm_check.service
Mon 2026-06-08 15:17:15 JST 50min left Mon 2026-06-08 13:39:04 JST 47min ago dnf-makecache.timer dnf-makecache.service
Tue 2026-06-09 00:00:00 JST 9h left Mon 2026-06-08 08:47:44 JST 5h 38min ago logrotate.timer logrotate.service
Tue 2026-06-09 00:00:00 JST 9h left Mon 2026-06-08 08:47:44 JST 5h 38min ago mlocate-updatedb.timer mlocate-updatedb.service
Tue 2026-06-09 00:00:00 JST 9h left - - sa-update.timer sa-update.service
Tue 2026-06-09 00:00:00 JST 9h left Mon 2026-06-08 08:47:44 JST 5h 38min ago unbound-anchor.timer unbound-anchor.service
Tue 2026-06-09 00:07:00 JST 9h left - - sysstat-summary.timer sysstat-summary.service
Tue 2026-06-09 00:08:00 JST 9h left Mon 2026-06-08 08:48:03 JST 5h 38min ago pmie_daily.timer pmie_daily.service
Tue 2026-06-09 00:10:00 JST 9h left Mon 2026-06-08 08:48:04 JST 5h 38min ago pmlogger_daily.timer pmlogger_daily.service
Tue 2026-06-09 03:47:00 JST 13h left - - snap.certbot.renew.timer snap.certbot.renew.service
Tue 2026-06-09 13:37:04 JST 23h left Mon 2026-06-08 13:37:04 JST 49min ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Sun 2026-06-14 01:00:00 JST 5 days left Sun 2026-06-07 09:06:35 JST 1 day 5h ago raid-check.timer raid-check.service
16 timers listed.
Pass --all to see loaded but inactive timers, too.
snap.certbot.renew.timer is registered
Check the unit file snap.certbot.renew.timer
# vi /etc/systemd/system/snap.certbot.renew.timer
[Unit]
# Auto-generated, DO NOT EDIT
Description=Timer renew for snap application certbot.renew
Requires=var-lib-snapd-snap-certbot-5603.mount
After=var-lib-snapd-snap-certbot-5603.mount
X-Snappy=yes
[Timer]
Unit=snap.certbot.renew.service
OnCalendar=*-*-* 03:47
OnCalendar=*-*-* 14:19
[Install]
WantedBy=timers.target
According to the above configuration, it will attempt to update at 03:47 and 14:19 every day as specified in the OnCalender parameter(However, the set time changes randomly with each update)
Check the unit file snap.certbot.renew.service
# vi /etc/systemd/system/snap.certbot.renew.service
[Unit]
# Auto-generated, DO NOT EDIT
Description=Service for snap application certbot.renew
Requires=var-lib-snapd-snap-certbot-5603.mount
Wants=network.target
After=var-lib-snapd-snap-certbot-5603.mount network.target snapd.apparmor.service
X-Snappy=yes
[Service]
EnvironmentFile=-/etc/environment
ExecStart=/usr/bin/snap run --timer="00:00~24:00/2" certbot.renew
SyslogIdentifier=certbot.renew
Restart=no
WorkingDirectory=/var/snap/certbot/5603
TimeoutStopSec=30s
Type=oneshot
However, the web server using the certificate will not be restarted, so set up a script to run automatically after the update
# vi /etc/letsencrypt/renewal-hooks/post/web_restart.sh
Please describe the following
#!/bin/bash
systemctl reload httpd
# vi /etc/httpd/conf.d/ssl.conf
Line 43 : Uncomments and make changes
DocumentRoot "/var/www/html/<FQDN>"
Line 44 : Uncomments and make changes
ServerName <FQDN>:443
Lin 85 : Add it as a comment below
# SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateFile /etc/letsencrypt/live/<FQDN>/cert.pem
Line 93 : Add it as a comment below
# SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
SSLCertificateKeyFile /etc/letsencrypt/live/<FQDN>/privkey.pem
Line 103 : Add
SSLCertificateChainFile /etc/letsencrypt/live/<FQDN>/chain.pem
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for mail.<Domain name>
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/mail.<Domain name>/fullchain.pem
Key is saved at: /etc/letsencrypt/live/mail.<Domain name>/privkey.pem
This certificate expires on 2026-09-06.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
3.2 Postfix Configuration
# vi /etc/postfix/main.cf
Per Line 709,715 : Commenting
#smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem
#smtpd_tls_key_file = /etc/pki/tls/private/postfix.key
Add to the last line
smtpd_use_tls = yes
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.<domain name>/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.<domain name>/privkey.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
# vi /etc/postfix/master.cf
Line17,18,20 : Uncomments
submission inet n - n - - smtpd
-o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
# -o smtpd_tls_auth_only=yes
Line 29-32 : Uncomments
smtps inet n - n - - smtpd
-o syslog_name=postfix/submissions
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
# -o smtpd_reject_unlisted_recipient=no
3.3 Dovecot Settings
# vi /etc/dovecot/conf.d/10-ssl.conf
Line 8：Confirmation
ssl = yes
Line 14,15：Add the following certificate/key file specification as a comment.
ssl_cert = </etc/letsencrypt/live/mail.<domain name>/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.<domain name>/privkey.pem
