Debian12.14 : Let's Encrypt, WEB/Mail Server SSL

Contents

1. Obtain a certificate (Let's Encrypt)

1.1 advance preparation

1.Enable mod_ssl

# a2enmod ssl

2.Package management system Snappy installed
Since the SSL certificate issuing tool "certbot" of Let's Encrypt is recommended to be installed using "snap" after 2021, install Snapd first.

Package management system Snappy

What is the package management system Snappy?Snappy is a pac...

# apt -y install snapd

Bring snapd version up to date

# snap install core
core 16-2.61.4-20260225 from Canonical✓ installed

# snap refresh core
snap "core" has no updates available

Version Check

# snap --version
snap    2.61.4ubuntu0.16.04.1+esm1
snapd   2.61.4ubuntu0.16.04.1+esm1
series  16
debian  12
kernel  6.1.0-48-amd64

1.2.certbot package install

# snap install --classic certbot
certbot 5.6.0 from Certbot Project (certbot-eff✓) installed

Create symbolic link to /snap/bin/certbot

# ln -s /snap/bin/certbot /usr/bin/certbot

Confirmation

# ls -la /usr/bin/certbot
lrwxrwxrwx 1 root root 17 May 28 22:08 /usr/bin/certbot -> /snap/bin/certbot

# ls -la /snap/bin/certbot
lrwxrwxrwx 1 root root 13 May 28 22:07 /snap/bin/certbot -> /usr/bin/snap

1.3 Obtain a Let's Encrypt Certificate

It is assumed that a web server such as Apache httpd or Nginx is running.
If the web server is not running on the server where the work is to be performed, follow the procedure below under "Obtaining a Let's Encrypt certificate when the web server is not running".
It is also assumed that the server on which the work is to be performed (the server with the FQDN of the server from which you want to obtain the certificate) is accessible from the Internet at port 80.

# certbot certonly --webroot -w /var/www/html/[FQDN] -d [FQDN]

First time only, you must register your e-mail address and agree to the Terms of Use Specify an e-mail address that can receive your messages.

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address or hit Enter to skip.
 (Enter 'c' to cancel): [mail address] 

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at:
https://letsencrypt.org/documents/LE-SA-v1.5-February-24-2025.pdf
You must agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
Account registered.
Requesting a certificate for [FQDN]

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/[FQDN]/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/[FQDN]/privkey.pem
This certificate expires on 2026-08-26.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

「Successfully received certificate.」
The following certificate is obtained under [/etc/letsencrypt/live/[FQDN]/] as described in the message
# cert.pem
# chain.pem
# fullchain.pem
# privkey.pem

Obtaining a Let's Encrypt certificate when the web server is not running
It is a prerequisite that the server on which the work is to be performed is accessible from the Internet at port 80.
#Use the simple Web server function by specifying [--standalone].
# -d [FQDN from which you want to obtain a certificate]
　FQDN (Fully Qualified Domain Name) : Hostname. Domain name without abbreviation
# If there are multiple FQDNs for which you want to obtain certificates, specify multiple -d [FQDNs for which you want to obtain certificates]

# certbot certonly --standalone -d [FQDN]

1.4 Automatic renewal of certificates (Let's Encrypt)

①Pre-registration testing
First, test the automatic renewal using the following --dry-run option. With this option, the certificate is not renewed, but only the operation is tested, so there is no need to worry about being caught by the limit on the number of times a certificate can be obtained.

# certbot renew --dry-run

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/[FQDN].conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Account registered.
Simulating renewal of an existing certificate for [FQDN]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all simulated renewals succeeded:
  /etc/letsencrypt/live/[FQDN]/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

②When you install the snap version of certbot, the automatic certificate renewal function is also installed.

# systemctl list-timers | less

NEXT                        LEFT          LAST                        PASSED       UNIT                         ACTIVATES
Thu 2026-05-28 22:39:00 JST 24min left    Thu 2026-05-28 22:09:01 JST 5min ago     phpsessionclean.timer        phpsessionclean.service
Fri 2026-05-29 00:00:00 JST 1h 45min left -                           -            dpkg-db-backup.timer         dpkg-db-backup.service
Fri 2026-05-29 00:00:00 JST 1h 45min left Thu 2026-05-28 18:32:33 JST 3h 41min ago logrotate.timer              logrotate.service
Fri 2026-05-29 02:13:29 JST 3h 59min left Wed 2026-05-27 13:31:30 JST 1 day 8h ago apt-daily.timer              apt-daily.service
Fri 2026-05-29 03:14:07 JST 4h 59min left Thu 2026-05-28 22:04:20 JST 10min ago    man-db.timer                 man-db.service
Fri 2026-05-29 06:11:16 JST 7h left       Thu 2026-05-28 18:44:01 JST 3h 30min ago apt-daily-upgrade.timer      apt-daily-upgrade.service
Fri 2026-05-29 06:12:00 JST 7h left       -                           -            snap.certbot.renew.timer     snap.certbot.renew.service
Fri 2026-05-29 21:20:46 JST 23h left      Thu 2026-05-28 18:47:20 JST 3h 27min ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Sun 2026-05-31 03:10:30 JST 2 days left   Tue 2026-05-26 10:23:25 JST 2 days ago   e2scrub_all.timer            e2scrub_all.service
Mon 2026-06-01 01:31:58 JST 3 days left   Tue 2026-05-26 10:23:25 JST 2 days ago   fstrim.timer                 fstrim.service

10 timers listed.
Pass --all to see loaded but inactive timers, too.

snap.certbot.renew.timer is registered
Check the unit file for snap.certbot.renew.timer

# vi /etc/systemd/system/snap.certbot.renew.timer

[Unit]
# Auto-generated, DO NOT EDIT
Description=Timer renew for snap application certbot.renew
Requires=snap-certbot-5603.mount
After=snap-certbot-5603.mount
X-Snappy=yes

[Timer]
Unit=snap.certbot.renew.service
OnCalendar=--* 03:24
OnCalendar=--* 16:53

[Install]
WantedBy=timers.target

According to the above settings, it will attempt to update at 03:24 and 16:53 every day as specified in the OnCalender parameter (however, the set time will change randomly for each update).

Check the unit file snap.certbot.renew.service

# vi /etc/systemd/system/snap.certbot.renew.service

[Unit]
#Auto-generated, DO NOT EDIT
Description=Service for snap application certbot.renew
Requires=snap-certbot-5603.mount
Wants=network.target
After=snap-certbot-5603.mount network.target snapd.apparmor.service
X-Snappy=yes

[Service]
EnvironmentFile=-/etc/environment
ExecStart=/usr/bin/snap run --timer="00:00~24:00/2" certbot.renew
SyslogIdentifier=certbot.renew
Restart=no
WorkingDirectory=/var/snap/certbot/5603
TimeoutStopSec=30
Type=oneshot

However, the web server that uses the certificate will not be restarted, so set up a script that will run automatically after the update

# vi /etc/letsencrypt/renewal-hooks/post/web_restart.sh

Please describe the following
#!/bin/bash
systemctl restart apache2

# chmod 755 /etc/letsencrypt/renewal-hooks/post/web_restart.sh

2. SSL/TLS (Let's Encrypt) configuration for Apache2

①Edit Apache2 SSL-related configuration files

# cd /etc/apache2/sites-available/
# cp default-ssl.conf vhost-ssl.conf　←　vhost-ssl can be any name

# vi vhost-ssl.conf
Line 2：Administrator address change
ServerAdmin <Email Address>>

Line 4：change
DocumentRoot /var/www/html/<FQDN>/

Line 12,13：change
ErrorLog ${APACHE_LOG_DIR}/<FQDN>.error.log
CustomLog ${APACHE_LOG_DIR}/<FQDN>.access.log combined

Lines 31,32: comment out and add below
SSLCertificateFile /etc/letsencrypt/live/<FQDN>/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/<FQDN>/privkey.pem

Per Line 41：Uncomment and change to the chain file
SSLCertificateChainFile /etc/letsencrypt/live/<FQDN>/chain.pem

②Reflecting and activating the configuration file

# a2ensite vhost-ssl.conf
Enabling site vhost-ssl.
To activate the new configuration, you need to run:
  systemctl reload apache2

Disable default
# a2dissite default-ssl.conf

Restart Apache
# systemctl restart apache2

③http to https redirect

# a2enmod rewrite

Add to the virtual host configuration file "vhost.conf"

# cd /etc/apache2/sites-available/

# vi vhost.conf
<VirtualHost *:80>
Add the following three lines
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] 
～omission～
ServerName <FQDN>
ServerAdmin <administrator E-mail address>
DocumentRoot /var/www/html/<FQDN>/
～omission～
ErrorLog ${APACHE_LOG_DIR}/<FQDN>.error.log
CustomLog ${APACHE_LOG_DIR}/<FQDN>.access.log combined
～omission～
</VirtualHost>

④Reflection of settings and startup

# a2ensite vhost.conf

Restart Apache
# systemctl restart apache2

https port open with ufw
# ufw allow https
# ufw reload

3. SSL/TLS (Let's Encrypt) settings on the mail server

3.1 Obtaining a certificate for the mail server

Obtain a certificate for the mail server, but it cannot be obtained in the same way as above, so the following with the "--standalone" option fails.

# certbot certonly --standalone -d mail.<domain name>

If I stop the web server once and then do it, it succeeds as follows

# systemctl stop apache2.service

# certbot certonly --standalone -d mail.<domain name>
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for mail.[domain]

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/mail.[domain]/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/mail.[domain]/privkey.pem
This certificate expires on 2026-08-26.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

# systemctl start apache2

3.2 Postfix Configuration

# vi /etc/postfix/main.cf

# Add to the last line
smtpd_use_tls = yes
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.<domain name>/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.<domain name>/privkey.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

# vi /etc/postfix/master.cf

#  Per Line 19-22 : Some comments removed
submission inet n - y - - smtpd
-o syslog_name=postfix/submission
#-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes

# Add to last line
smtps     inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes

3.3 Dovecot Configuration

# vi /etc/dovecot/conf.d/10-ssl.conf

Line 6：change
ssl = yes

Line 12,13：Comment and add the following certificate/key file specification
ssl_cert = </etc/letsencrypt/live/mail.<domain name>/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.<domain name>/privkey.pem

Allow Port 587