1.Package management system Snappy installed Since the SSL certificate issuing tool "certbot" of Let's Encrypt is recommended to be installed using "snap" after 2021, install Snapd first.(Can also be installed the traditional way with dnf or yum)
You must agree in
order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
Account registered.
Requesting a certificate for [FQDN]
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/[FQDN]/fullchain.pem
Key is saved at: /etc/letsencrypt/live/[FQDN]/privkey.pem
This certificate expires on 2026-09-01.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
We were unable to subscribe you the EFF mailing list because your e-mail address appears to be invalid. You can try again later by visiting https://act.eff.org.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Success if displayed"Successfully received certificate". The following certificate is obtained under [/etc/letsencrypt/live/<FQDN>/] as described in the message cert.pem ⇒ SSL server certificate (including public key) chain.pem ⇒ intermediate certificate fullchain.pem ⇒ File containing cert.pem and chain.pem combined privkey.pem ⇒ private key
※ Obtaining a Let's Encrypt certificate when the web server is not running
It is a prerequisite that the server on which the work is to be performed is accessible from the Internet at port 80. ・ Use the simple Web server function by specifying [--standalone]. ・d [FQDN for which you wish to obtain a certificate]# FQDN (Fully Qualified Domain Name) : Hostname.Domain name written without omission ・If you have multiple FQDNs for which you want to obtain certificates, specify them multiple times using -d [FQDNs for which you want to obtain certificates].
# certbot certonly --standalone -d <FQDN>
Renewing certificates already obtained ・Renew all certificates with an expiration date of less than 30 days ・If you want to renew regardless of the number of days remaining on the expiration date, specify [--force-renewal] as well.
# certbot [--force-renewal] renew
1.2 Automatic renewal of certificates(Let's Encrypt)
①Pre-registration testing First, test the automatic update using the following --dry-run option. With this option, certificates are not renewed, only checked, so there is no need to worry about getting stuck with a limit on the number of times a certificate can be obtained.
# vi /etc/systemd/system/snap.certbot.renew.timer
[Unit]
# Auto-generated, DO NOT EDIT
Description=Timer renew for snap application certbot.renew
Requires=var-lib-snapd-snap-certbot-5603.mount
After=var-lib-snapd-snap-certbot-5603.mount
X-Snappy=yes
[Timer]
Unit=snap.certbot.renew.service
OnCalendar=*-*-* 02:45
OnCalendar=*-*-* 14:54
[Install]
WantedBy=timers.target
According to the above settings, updates will be attempted at 2:45 and 14:54 daily as specified by the OnCalendar parameter (however, the set time will change randomly for each update).
Check the unit file snap.certbot.renew.service
# vi /etc/systemd/system/snap.certbot.renew.service
[Unit]
# Auto-generated, DO NOT EDIT
Description=Service for snap application certbot.renew
Requires=var-lib-snapd-snap-certbot-5603.mount
Wants=network.target
After=var-lib-snapd-snap-certbot-5603.mount network.target snapd.apparmor.service
X-Snappy=yes
[Service]
EnvironmentFile=-/etc/environment
ExecStart=/usr/bin/snap run --timer="00:00~24:00/2" certbot.renew
SyslogIdentifier=certbot.renew
Restart=no
WorkingDirectory=/var/snap/certbot/5603
TimeoutStopSec=30
Type=oneshot
However, the web server using the certificate will not be restarted, so set up a script to run automatically after the update
# vi /etc/letsencrypt/renewal-hooks/post/web_restart.sh
Please describe the following
#!/bin/bash
systemctl reload httpd
# vi /etc/httpd/conf.d/ssl.conf
Line 43 : Uncomment and change
DocumentRoot "/var/www/html/<FQDN>"
Line 44 : Uncomment and change
ServerName <FQDN>:443
Line 85 : Make it a comment and add it below
# SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateFile /etc/letsencrypt/live/<FQDN>/cert.pem
Line 93 : Make it a comment and add it below
# SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
SSLCertificateKeyFile /etc/letsencrypt/live/<FQDN>/privkey.pem
Line 103 : Add
SSLCertificateChainFile /etc/letsencrypt/live/<FQDN>/chain.pem
# vi /etc/httpd/conf.d/vhost.conf
<VirtualHost *:80>
Add the following three lines
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
DocumentRoot /var/www/html/[FQDN]
ServerName [FQDN]
ServerAdmin [mail address]
ErrorLog logs/[FQDN].error_log
CustomLog logs/[FQDN].access_log combined
</VirtualHost>
<Directory "/var/www/html/[FQDN]">
Options FollowSymLinks
AllowOverride All
</Directory>
Restart Apache
# systemctl restart httpd
3. SSL/TLS (Let's Encrypt) settings on the mail server
3.1 Obtaining a certificate for the mail server
Obtain a certificate for the mail server Since it cannot be obtained using the same method as above, adding the "--standalone" option as shown below also fails.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for mail.<Domain name>
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/mail.<Domain name>/fullchain.pem
Key is saved at: /etc/letsencrypt/live/mail.<Domain name>/privkey.pem
This certificate expires on 2026-09-01.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
3.2 Postfix Configuration
# vi /etc/postfix/main.cf
Lines 718 and 724: Commented out
#smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem
#smtpd_tls_key_file = /etc/pki/tls/private/postfix.key
Add to the last line
smtpd_use_tls = yes
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.<domain name>/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.<domain name>/privkey.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
# vi /etc/postfix/master.cf
Line 19,20,22 : Uncomment
submission inet n - n - - smtpd
-o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
# -o smtpd_tls_auth_only=yes
Lines 38-41: Uncomment
submissions inet n - n - - smtpd
-o syslog_name=postfix/submissions
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
# -o local_header_rewrite_clients=static:all
# -o smtpd_reject_unlisted_recipient=no
3.3 Dovecot Settings
# vi /etc/dovecot/conf.d/10-ssl.conf
Line 8：confirmation
ssl = yes
Line 14,15：Make it a comment and add certificate/key file designation under it
ssl_cert = </etc/letsencrypt/live/mail.<domain name>/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.<domain name>/privkey.pem
