1

Topic: From manual to automatic certificate renewal -> last steps needed

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.5.1 MARIADB edition.
- Deployed with iRedMail Easy or the downloadable installer? yes
- Linux/BSD distribution name and version: CENTOS STREAM 8
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):  MySQL
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.

This is a information request for auto renewal for letsencrypt certificates

Current situation:

/etc/pki/tls/private/iRedMail.key -> /etc/letsencrypt/live/mydomain.com/privkey.pem
/etc/pki/tls/certs/iRedMail.crt -> /etc/letsencrypt/live/mydomain.com/fullchain.pem

Old letsencrypt method: certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini   
New letsencrypy method: acme.sh (source: github.com/acmesh-official/acme.sh)

The new method creates letsencrypt certificates and stores these in /root/.acme.sh/mydomain.com

So far this all works but replacing the new certificates permanently within Iredmail is not clear yet. I linked the iRedMail.key & iRedMail.crt to the newly generated keys in /root/.acme.sh/mydomain.com, but I ran in certificate issues with the webserver (and maybe postfix, which I did not test)


Questions:

- How and what needs to be copied so the existing configuration remains unchanged
- How can I check that the correct certificate is in use
- Am I notified that the certificates are expiring in the future

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: From manual to automatic certificate renewal -> last steps needed

acme.sh supports copying cert/key files to somewhere.

3

Re: From manual to automatic certificate renewal -> last steps needed

Thanks for your help. I was able to get this working by implementing the following step on top of my installation

Source: https://github.com/gearrington/acme-dns-certbot-joohoi

After some reading I got the following result

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/mydomain.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/mydomain.com/privkey.pem
This certificate expires on 2022-10-02.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Case closed