Rocky Linux8.6 : Let's Encrypt , Apache Mail SSL

1.Obtain SSL Certificate ( Let's Encrypt )

Install the latest open ssl

1.1 Certificate Installation

# Registration of e-mail address and agreement to terms of use are required for the first time only.
# Specify an email address to receive

Success when displaye ""Successfully received certificate"

# The following certificate is obtained under [/etc/letsencrypt/live/<FQDN>/] as described in the message
# cert.pem ⇒ SSL server certificate (including public key)
# chain.pem ⇒ intermediate certificate
# fullchain.pem ⇒ File containing cert.pem and chain.pem combined
# privkey.pem ⇒ private key

※ Obtaining a Let's Encrypt certificate when the web server is not running

It is a prerequisite that the server on which the work is to be performed is accessible from the Internet at port 80.

#Use the simple Web server function by specifying [--standalone].
#-d [FQDN for which you want to get a certificate] # FQDN (Fully Qualified Domain Name) : Host Name. Fully Qualified Domain Name
#If there are multiple FQDNs for which you want to obtain certificates, specify multiple -d [FQDNs for which you want to obtain certificates

Renewing certificates already obtained
# Renew all certificates with an expiration date of less than 30 days
# If you want to renew regardless of the number of days remaining on the expiration date, specify [--force-renewal] as well

1.2 Automatic renewal of certificates (Let's Encrypt)

①Pre-registration testing
Test the automatic renewal with the following --dry-run option. With this option, the certificate is not renewed and only the operation is tested, so there is no need to worry about getting caught in the limit of the number of times a certificate can be obtained.

②Using Systemd Timer

2. Apache SSL

Install the following just in case

2.1 Edit ssl.conf file

Restart Apache.
Allow https in Firewall

2.2 Redirect HTTP communications to HTTPS

Create .htaccess under /var/www/html/[FQDN]/.
Contents of .htaccess

3. Mail SSL/TLS(Let's Encrypt)

3.1 Obtaining a certificate for the mail server

Obtain a certificate for the mail server, but it cannot be obtained in the same way as above, so the following with the "--standalone" option fails.

If I stop the web server once and then do it, it succeeds as follows

3.2 Postfix Configuration

3.3 Dovecot Settings

Allow Port 587 in firewall

3.4 Thunderbird Settings

receiving server
Port  :  143
Connection security   :  STARTTLS
Authentication method  :  Normal password
sending server
Port   :  587
Connection security   :  STARTTLS
Authentication method  :  Normal password
タイトルとURLをコピーしました