VestaCP SSL for mail server
VestaCP install self signed SSL for mail server by default. To install valid SSL, login to VestCP, go to sites. You will see a site with your sites hostname. If you don’t see it, create a site with your server hostname. Make sure DNS edited so hostname resolve to server IP. Now you should be able to get free LetsEncrypt SSL for this site.
if you check Apache Virtual Host for the site, you will see someting like
SSLCertificateFile /home/admin/conf/web/ssl.HOSTNAME.crt SSLCertificateKeyFile /home/admin/conf/web/ssl.HOSTNAME.key SSLCertificateChainFile /home/admin/conf/web/ssl.HOSTNAME.ca
In VeataCP the config files for exim and dovecot located at
/etc/exim4/exim4.conf.template /etc/dovecot/conf.d/10-ssl.conf
These configs use SSL located at /usr/local/vesta/ssl/certificate.crt and /usr/local/vesta/ssl/certificate.key.
To use the FREE SSL, create a bash script.
mkdir /usr/serverok/ vi /usr/serverok/ssl-renew-hostname
Add
#!/bin/bash # Author: ServerOk Software # Web: www.serverok.in # Email: [email protected] cat /home/admin/conf/web/ssl.HOSTNAME.crt > /usr/local/vesta/ssl/certificate.crt cat /home/admin/conf/web/ssl.HOSTNAME.ca >> /usr/local/vesta/ssl/certificate.crt cat /home/admin/conf/web/ssl.HOSTNAME.key > /usr/local/vesta/ssl/certificate.key systemctl restart apache2 systemctl restart exim4 systemctl restart dovecot /usr/local/vesta/nginx/sbin/vesta-nginx -s reload
make the file executable
chmod 755 /usr/serverok/ssl-renew-hostname
Run the script
/usr/serverok/ssl-renew-hostname
Now SSL will work for mail server and VestaCP. To access VestaCP, use
https://HOSTNAME:8083/login/
Verify Mail Server SSL
You can view mail server SSL with command
openssl s_client -showcerts -connect HOSTNAME:993 openssl s_client -showcerts -connect HOSTNAME:465 openssl s_client -starttls smtp -showcerts -connect HOSTNAME:587
Replace HOSTNAME with actual hostname of your server.
Auto Renew SSL
LetsEncrypt SSL expire every 90 days. So we will create a cronjob to auto renew SSL. Ff you have a paid SSL, you don’t need this cronjob
Create a cronjob with
crontab -e
Add
@weekly /usr/serverok/ssl-renew-hostname > /dev/null 2>&1
Related Posts