Contents
1.Obtain SSL Certificate( Let's Encrypt )
1.1 advance preparation
1.Install the latest open ssl
|
1 |
# dnf install openssl-devel |
2.Package management system Snappy installed
Since the SSL certificate issuing tool "certbot" of Let's Encrypt is recommended to be installed using "snap" after 2021, install Snapd first.(Can also be installed the traditional way with dnf or yum)
|
1 2 3 |
# dnf install epel-release # dnf upgrade # dnf install snapd |
Enable systemd unit to manage the main snap communication socket
|
1 2 |
# systemctl enable --now snapd.socket Created symlink /etc/systemd/system/sockets.target.wants/snapd.socket → /usr/lib/systemd/system/snapd.socket. |
Enable Classics Snap support
|
1 |
# ln -s /var/lib/snapd/snap /snap |
Bring snapd version up to date
|
1 |
# snap install core |
If the above fails, run the following command instead (the core package will be installed along with the package called hello-world)
|
1 |
# snap install hello-world |
Update core package
|
1 |
# snap refresh core |
Version Check
|
1 2 3 4 5 6 |
# snap --version snap 2.67-0.el10_0 snapd 2.67-0.el10_0 series 16 centos 10 kernel 6.12.0-59.el10.x86_64 |
Log out and log in again or reboot the system to ensure that the snap path is updated correctly
3.certbot package install
|
1 2 |
# snap install --classic certbot certbot 3.3.0 from Certbot Project (certbot-eff✓) installed |
Create symbolic link to /snap/bin/certbot
|
1 |
# ln -s /snap/bin/certbot /usr/bin/certbot |
Confirmation
|
1 2 3 4 5 |
# ls -la /usr/bin/certbot lrwxrwxrwx 1 root root 17 Aug 24 11:06 /usr/bin/certbot -> /snap/bin/certbot # ls -la /snap/bin/certbot lrwxrwxrwx 1 root root 13 Aug 24 11:06 /snap/bin/certbot -> /usr/bin/snap |
1.2 Obtaining Certificates
|
1 |
# certbot certonly --webroot -w /var/www/html/[FQDN] -d [FQDN] |
Registration of e-mail address and agreement to terms of use are required for the first time only.
Specify an email address to receive
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 |
Saving debug log to /var/log/letsencrypt/letsencrypt.log Enter email address or hit Enter to skip. (Enter 'c' to cancel): [mail address] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please read the Terms of Service at: https://letsencrypt.org/documents/LE-SA-v1.5-February-24-2025.pdf You must agree in order to register with the ACME server. Do you agree? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: y - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Would you be willing, once your first certificate is successfully issued, to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: y Account registered. Requesting a certificate for [FQDN] Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/[FQDN]/fullchain.pem Key is saved at: /etc/letsencrypt/live/[FQDN]/privkey.pem This certificate expires on 2025-06-16. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in the background. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - If you like Certbot, please consider supporting our work by: * Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate * Donating to EFF: https://eff.org/donate-le - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
Success if displayed"Successfully received certificate".
The following certificate is obtained under [/etc/letsencrypt/live/<FQDN>/] as described in the message
cert.pem ⇒ SSL server certificate (including public key)
chain.pem ⇒ intermediate certificate
fullchain.pem ⇒ File containing cert.pem and chain.pem combined
privkey.pem ⇒ private key
1.3 Automatic renewal of certificates(Let's Encrypt)
①Pre-registration testing
First, test the automatic update using the following --dry-run option.
With this option, certificates are not renewed, only checked, so there is no need to worry about getting stuck with a limit on the number of times a certificate can be obtained.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
# certbot renew --dry-run Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /etc/letsencrypt/renewal/[FQDN].conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Account registered. Simulating renewal of an existing certificate for [FQDN] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations, all simulated renewals succeeded: /etc/letsencrypt/live/[FQDN]/fullchain.pem (success) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
➁Automatically renew SSL certificates using cron (run at midnight on the 1st of each month)
|
1 2 |
# crontab -e 0 0 1 * * certbot renew --pre-hook "systemctl stop httpd" --post-hook "systemctl start httpd" |
2. Apache https
Install the following
|
1 |
# dnf -y install mod_ssl |
2.1 Edit ssl.conf file
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
# vi /etc/httpd/conf.d/ssl.conf ●Line 43 : Uncomment and change DocumentRoot "/var/www/html/<FQDN>" ●Line 44 : Uncomment and change ServerName <Domain name>:443 ●Line 85 : Make it a comment and add it below # SSLCertificateFile /etc/pki/tls/certs/localhost.crt SSLCertificateFile /etc/letsencrypt/live/<FQDN>/cert.pem ●Line 93 : Make it a comment and add it below # SSLCertificateKeyFile /etc/pki/tls/private/localhost.key SSLCertificateKeyFile /etc/letsencrypt/live/<FQDN>/privkey.pem ●Line 103 : Add SSLCertificateChainFile /etc/letsencrypt/live/<FQDN>/chain.pem |
Apache restart
|
1 |
# systemctl restart httpd |
Allow https in Firewall
|
1 2 3 4 |
# firewall-cmd --add-service=https --permanent success # firewall-cmd --reload success |
2.2 Redirect HTTP communications to HTTPS
Add the following to /etc/httpd/conf.d/vhost.conf
|
1 2 3 |
RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] |
3. SSL/TLS (Let's Encrypt) settings on the mail server
3.1 Obtaining a Certificate for Mail Server
Obtain a certificate for the mail server, but it cannot be obtained in the same way as above, so the following with the "--standalone" option fails.
|
1 |
# certbot certonly --standalone -d mail.<domain name> |
If I stop the web server once and then do it, it succeeds as follows
|
1 2 |
# systemctl stop httpd.service # certbot certonly --standalone -d mail.<domain name> |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
Saving debug log to /var/log/letsencrypt/letsencrypt.log Requesting a certificate for mail.[domain] Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/mail.[domain]/fullchain.pem Key is saved at: /etc/letsencrypt/live/mail.[domain]/privkey.pem This certificate expires on 2025-06-16. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in the background. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - If you like Certbot, please consider supporting our work by: * Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate * Donating to EFF: https://eff.org/donate-le - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
3.2 Postfix Configuration
|
1 2 3 4 5 6 7 8 9 10 11 |
# vi /etc/postfix/main.cf ● Per Line 718, 724 : Comment #smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem #smtpd_tls_key_file = /etc/pki/tls/private/postfix.key ● Add to the last line smtpd_use_tls = yes smtp_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3 smtpd_tls_cert_file = /etc/letsencrypt/live/mail.<domain name>/fullchain.pem smtpd_tls_key_file = /etc/letsencrypt/live/mail.<domain name>/privkey.pem smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache |
|
1 2 3 4 5 6 7 8 9 10 11 |
# vi /etc/postfix/master.cf ● Line 20-23 : Uncomment submission inet n - n - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes ● Line 39-42 : Uncomment #submissions inet n - n - - smtpd -o syslog_name=postfix/submissions -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes |
3.3 Dovecot Configuration
|
1 2 3 4 5 6 |
# vi /etc/dovecot/conf.d/10-ssl.conf ●Line 8：Confirmation ssl = yes ●Line 14,15：Comment and add the following certificate/key file specification ssl_cert = </etc/letsencrypt/live/mail.<domain name>/fullchain.pem ssl_key = </etc/letsencrypt/live/mail.<domain name>/privkey.pem |
Allow Port 587 in firewall
|
1 2 |
# firewall-cmd --add-port=587/tcp --permanent # firewall-cmd --reload |
|
1 |
# systemctl restart postfix dovecot |
3.4 Thunderbird Settings
Receiving server
Port : 143
Connection security : STARTTLS
Authentication method : Normal password
Sending server
Port : 587
Connection security : STARTTLS
Authentication method : Normal password
