Rocky Linux8.6 : Let's Encrypt , Apache Mail SSL

1.Obtain SSL Certificate ( Let's Encrypt )

Install the latest open ssl

# dnf install openssl-devel

1.1 Certificate Installation

# dnf -y install certbot
# certbot certonly --webroot -w /var/www/html/[domain name] -d [domain name]
# Registration of e-mail address and agreement to terms of use are required for the first time only.
# Specify an email address to receive
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Enter email address (used for urgent renewal and security notices)
(Enter 'c' to cancel):<Email-address>
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
Account registered.
Requesting a certificate for <Domain name>
Performing the following challenges:
http-01 challenge for <Domain name>
Using the webroot path /var/www/html/<Domain name> for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Subscribe to the EFF mailing list (email: <Email-address>).
We were unable to subscribe you the EFF mailing list because your e-mail address appears to be invalid. You can try again later by visiting https://act.eff.org.
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/<Domain name>/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/<Domain name>/privkey.pem
Your certificate will expire on 2022-08-27. To obtain a new or
tweaked version of this certificate in the future, simply run
certbot again. To non-interactively renew *all* of your
certificates, run "certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
Success if displayed "Congratulations! Your certificate and chain have been saved at:"

# The following certificate is obtained under [/etc/letsencrypt/live/<Domain name>/] as described in the message
# cert.pem ⇒ SSL server certificate (including public key)
# chain.pem ⇒ intermediate certificate
# fullchain.pem ⇒ File containing cert.pem and chain.pem combined
# privkey.pem ⇒ private key

※ Obtaining a Let's Encrypt certificate when the web server is not running

It is a prerequisite that the server on which the work is to be performed is accessible from the Internet at port 80.

#Use the simple Web server function by specifying [--standalone].
#-d [FQDN for which you want to get a certificate] # FQDN (Fully Qualified Domain Name) : Host Name. Fully Qualified Domain Name
#If there are multiple FQDNs for which you want to obtain certificates, specify multiple -d [FQDNs for which you want to obtain certificates

# certbot certonly --standalone -d <Domain name>

Renewing certificates already obtained
# Renew all certificates with an expiration date of less than 30 days
# If you want to renew regardless of the number of days remaining on the expiration date, specify [--force-renewal] as well

# certbot  [--force-renewal]  renew

1.2 Automatic renewal of certificates (Let's Encrypt)

①Pre-registration testing
Test the automatic renewal with the following --dry-run option. With this option, the certificate is not renewed and only the operation is tested, so there is no need to worry about getting caught in the limit of the number of times a certificate can be obtained.

#certbot renew --dry-run

②Using Systemd Timer

# systemctl cat certbot-renew.timer
# /usr/lib/systemd/system/certbot-renew.timer
[Unit] Description=This is the timer to set the schedule for automated renewals
[Timer] OnCalendar=*-*-* 00/12:00:00
RandomizedDelaySec=12hours
Persistent=true
[Install] WantedBy=timers.target
# systemctl enable --now certbot-renew.timer
# systemctl list-timers certbot-renew.timer
NEXT LEFT LAST PASSED UNIT ACTIVATES
Fri 2022-06-10 15:17:07 JST 4h 39min left n/a n/a certbot-renew.timer certbot-renew.service
1 timers listed.
Pass --all to see loaded but inactive timers, too.

2. Apache SSL

Install the following just in case

# dnf -y install mod_ssl

2.1 Edit ssl.conf file

# vi /etc/httpd/conf.d/ssl.conf
●Line 43 : Uncomment and change
DocumentRoot "/var/www/html/<domain name>"
●Line 44 : Uncomment and change
ServerName <domain name>:443
●Line 85 : Comment-out and add it below
# SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateFile  /etc/letsencrypt/live/<domain name>/cert.pem
●Lin 93 : Comment-out and add it below
# SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
SSLCertificateKeyFile /etc/letsencrypt/live/<domain name>/privkey.pem
●Line 103 :  add
SSLCertificateChainFile /etc/letsencrypt/live/<domain name>/chain.pem
Restart Apache.
# systemctl restart httpd
Allow https in Firewall
# firewall-cmd --add-service=https --permanent
success
# firewall-cmd --reload
success

2.2 Redirect HTTP communications to HTTPS

Create .htaccess under /var/www/html/[domain]/.
Contents of .htaccess
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

3. Mail SSL/TLS(Let's Encrypt)

3.1 Obtaining a certificate for the mail server

Obtain a certificate for the mail server, but it cannot be obtained in the same way as above, so the following with the "--standalone" option fails.

# certbot certonly --standalone -d mail.<domain name>

If I stop the web server once and then do it, it succeeds as follows

# systemctl stop httpd.service
# certbot certonly --standalone -d mail.<domain name>
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Requesting a certificate for mail.<domain name>
Performing the following challenges:
http-01 challenge for mail.<domain name>
Waiting for verification...
Cleaning up challenges
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/mail.<domain name>/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/mail.<domain name>/privkey.pem
Your certificate will expire on 2022-08-27. To obtain a new or
tweaked version of this certificate in the future, simply run
certbot again. To non-interactively renew *all* of your
certificates, run "certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le

3.2 Postfix Configuration

# vi /etc/postfix/main.cf
● Per line 709, 715 : comment
#smtpd_tls_cert_file = /etc/pki/tls/certs/postfix.pem
#smtpd_tls_key_file = /etc/pki/tls/private/postfix.key
● Add to the last line
smtpd_use_tls = yes
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.<domain name>/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.<domain name>/privkey.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
# vi /etc/postfix/master.cf
● Line 19-22 : Uncomment
submission inet n - n - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
● Line 31-34 : Uncomment
smtps inet n - n - - smtpd
-o syslog_name=postfix/smtps
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes

3.3 Dovecot Settings

# vi /etc/dovecot/conf.d/10-ssl.conf
● Line 8:confirmation
ssl = yes
● Line 14,15: comment and add it below
#ssl_cert = </etc/pki/dovecot/certs/dovecot.pem
#ssl_key = </etc/pki/dovecot/private/dovecot.pem
ssl_cert = </etc/letsencrypt/live/mail.<domain name>/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.<domain name>/privkey.pem
Allow Port 587 in firewall
# firewall-cmd --add-port=587/tcp --permanent
# firewall-cmd --reload
# systemctl restart postfix dovecot

3.4 Thunderbird Settings

receiving server
Port  :  143
Connection security   :  STARTTLS
Authentication method  :  Normal password
sending server
Port   :  587
Connection security   :  STARTTLS
Authentication method  :  Normal password
タイトルとURLをコピーしました