1.Package management system Snappy installed Since the SSL certificate issuing tool "certbot" of Let's Encrypt is recommended to be installed using "snap" after 2021, install Snapd first.(Can also be installed the traditional way with dnf or yum)
You must agree in
order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
Account registered.
Requesting a certificate for [FQDN]
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/[FQDN]/fullchain.pem
Key is saved at: /etc/letsencrypt/live/[FQDN]/privkey.pem
This certificate expires on 2026-09-10.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
We were unable to subscribe you the EFF mailing list because your e-mail address appears to be invalid. You can try again later by visiting https://act.eff.org.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Success if displayed"Successfully received certificate". The following certificate is obtained under [/etc/letsencrypt/live/<FQDN>/] as described in the message cert.pem ⇒ SSL server certificate (including public key) chain.pem ⇒ intermediate certificate fullchain.pem ⇒ File containing cert.pem and chain.pem combined privkey.pem ⇒ private key
※ Obtaining a Let's Encrypt certificate when the web server is not running
It is a prerequisite that the server on which the work is to be performed is accessible from the Internet at port 80. ・ Use the simple Web server function by specifying [--standalone]. ・d [FQDN for which you wish to obtain a certificate]# FQDN (Fully Qualified Domain Name) : Hostname.Domain name written without omission ・If you have multiple FQDNs for which you want to obtain certificates, specify them multiple times using -d [FQDNs for which you want to obtain certificates].
# certbot certonly --standalone -d <FQDN>
Renewing certificates already obtained ・Renew all certificates with an expiration date of less than 30 days ・If you want to renew regardless of the number of days remaining on the expiration date, specify [--force-renewal] as well.
# certbot [--force-renewal] renew
1.2 Automatic renewal of certificates(Let's Encrypt)
①Pre-registration testing First, test the automatic update using the following --dry-run option. With this option, certificates are not renewed, only checked, so there is no need to worry about getting stuck with a limit on the number of times a certificate can be obtained.
②When you install the snap version of certbot, the automatic certificate renewal function is also installed.
# systemctl list-timers | less
NEXT LEFT LAST PASSED UNIT ACTIVATES
Fri 2026-06-12 12:58:00 JST 1min 26s Fri 2026-06-12 12:28:06 JST 28min ago pmie_check.timer pmie_check.service
Fri 2026-06-12 12:58:10 JST 1min 36s Fri 2026-06-12 12:28:16 JST 28min ago pmie_farm_check.timer pmie_farm_check.service
Fri 2026-06-12 13:00:00 JST 3min 26s Fri 2026-06-12 12:50:00 JST 6min ago sysstat-collect.timer sysstat-collect.service
Fri 2026-06-12 13:20:00 JST 23min Fri 2026-06-12 12:50:00 JST 6min ago pmlogger_check.timer pmlogger_check.service
Fri 2026-06-12 13:20:10 JST 23min Fri 2026-06-12 12:50:10 JST 6min ago pmlogger_farm_check.timer pmlogger_farm_check.service
Fri 2026-06-12 13:31:44 JST 35min Fri 2026-06-12 11:35:56 JST 1h 20min ago dnf-makecache.timer dnf-makecache.service
Fri 2026-06-12 23:42:00 JST 10h - - snap.certbot.renew.timer snap.certbot.renew.service
Sat 2026-06-13 00:00:00 JST 11h - - sa-update.timer sa-update.service
Sat 2026-06-13 00:00:00 JST 11h - - sysstat-rotate.timer sysstat-rotate.service
Sat 2026-06-13 00:00:00 JST 11h Fri 2026-06-12 09:18:14 JST - unbound-anchor.timer unbound-anchor.service
Sat 2026-06-13 00:07:00 JST 11h - - sysstat-summary.timer sysstat-summary.service
Sat 2026-06-13 00:08:00 JST 11h Fri 2026-06-12 09:18:27 JST - pmie_daily.timer pmie_daily.service
Sat 2026-06-13 00:10:00 JST 11h Fri 2026-06-12 09:18:28 JST - pmlogger_daily.timer pmlogger_daily.service
Sat 2026-06-13 00:14:52 JST 11h Fri 2026-06-12 09:30:19 JST 3h 26min ago plocate-updatedb.timer plocate-updatedb.service
Sat 2026-06-13 00:23:05 JST 11h Fri 2026-06-12 10:02:52 JST 2h 53min ago logrotate.timer logrotate.service
Sat 2026-06-13 09:37:29 JST 20h Fri 2026-06-12 09:37:29 JST 3h 19min ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Sun 2026-06-14 01:00:00 JST 1 day 12h Thu 2026-06-11 17:15:57 JST - raid-check.timer raid-check.service
Mon 2026-06-15 01:38:49 JST 2 days Thu 2026-06-11 17:15:57 JST - fstrim.timer fstrim.service
18 timers listed.
Pass --all to see loaded but inactive timers, too.
snap.certbot.renew.timer is registered
Check the unit file snap.certbot.renew.timer
# vi /etc/systemd/system/snap.certbot.renew.timer
[Unit]
# Auto-generated, DO NOT EDIT
Description=Timer renew for snap application certbot.renew
Requires=var-lib-snapd-snap-certbot-5603.mount
After=var-lib-snapd-snap-certbot-5603.mount
X-Snappy=yes
[Timer]
Unit=snap.certbot.renew.service
OnCalendar=*-*-* 08:15
OnCalendar=*-*-* 23:42
[Install]
WantedBy=timers.target
According to the above settings, updates will be attempted at 8:15 and 23:42 daily as specified by the OnCalendar parameter (however, the set time will change randomly for each update).
Check the unit file snap.certbot.renew.service
# vi /etc/systemd/system/snap.certbot.renew.service
[Unit]
# Auto-generated, DO NOT EDIT
Description=Service for snap application certbot.renew
Requires=var-lib-snapd-snap-certbot-5603.mount
Wants=network.target
After=var-lib-snapd-snap-certbot-5603.mount network.target snapd.apparmor.service
X-Snappy=yes
[Service]
EnvironmentFile=-/etc/environment
ExecStart=/usr/bin/snap run --timer="00:00~24:00/2" certbot.renew
SyslogIdentifier=certbot.renew
Restart=no
WorkingDirectory=/var/snap/certbot/5603
TimeoutStopSec=30
Type=oneshot
However, the web server using the certificate will not be restarted, so set up a script to run automatically after the update
# vi /etc/letsencrypt/renewal-hooks/post/web_restart.sh
Please describe the following
#!/bin/bash
systemctl reload httpd
# vi /etc/httpd/conf.d/ssl.conf
Line 43 : Uncomment and change
DocumentRoot "/var/www/html/<FQDN>"
Line 44 : Uncomment and change
ServerName <FQDN>:443
Line 85 : Make it a comment and add it below
# SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateFile /etc/letsencrypt/live/<FQDN>/cert.pem
Line 93 : Make it a comment and add it below
# SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
SSLCertificateKeyFile /etc/letsencrypt/live/<FQDN>/privkey.pem
Line 103 : Add
SSLCertificateChainFile /etc/letsencrypt/live/<FQDN>/chain.pem
# vi /etc/httpd/conf.d/vhost.conf
<VirtualHost *:80>
Add the following three lines
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
DocumentRoot /var/www/html/[FQDN]
ServerName [FQDN]
ServerAdmin [mail address]
ErrorLog logs/[FQDN].error_log
CustomLog logs/[FQDN].access_log combined
</VirtualHost>
<Directory "/var/www/html/[FQDN]">
Options FollowSymLinks
AllowOverride All
</Directory>
Restart Apache
# systemctl restart httpd
3. SSL/TLS (Let's Encrypt) settings on the mail server
3.1 Obtaining a certificate for the mail server
Obtain a certificate for the mail server Since it cannot be obtained using the same method as above, adding the "--standalone" option as shown below also fails.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for mail.<Domain>
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/mail.<Domain>/fullchain.pem
Key is saved at: /etc/letsencrypt/live/mail.<Domain>/privkey.pem
This certificate expires on 2026-09-10.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
3.2 Postfix Configuration
# vi /etc/postfix/main.cf
Per Lines 718 and 724: Commented out
#smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem
#smtpd_tls_key_file = /etc/pki/tls/private/postfix.key
Add to the last line
smtpd_use_tls = yes
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.<domain>/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.<domain>/privkey.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
# vi /etc/postfix/master.cf
Line 19,20,22 : Uncomment
submission inet n - n - - smtpd
-o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
# -o smtpd_tls_auth_only=yes
Lines 38-41: Uncomment
submissions inet n - n - - smtpd
-o syslog_name=postfix/submissions
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
# -o local_header_rewrite_clients=static:all
# -o smtpd_reject_unlisted_recipient=no
3.3 Dovecot Settings
# vi /etc/dovecot/conf.d/10-ssl.conf
Line 8：confirmation
ssl = yes
Line 14,15：Make it a comment and add certificate/key file designation under it
ssl_cert = </etc/letsencrypt/live/mail.<domain>/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.<domain>/privkey.pem
