Postal
TLS CERT CADDY #2673
-
|
I have read a lot of issue and post about that, but which is the best way to copy/share/use cert from caddy? |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments 9 replies
-
|
I think this is the best summary I've seen of it #2626 (comment) |
Beta Was this translation helpful? Give feedback.
-
|
thx. this is one of the issue i had read, but its not better mount a volume in postal shared with caddy when we install postal? |
Beta Was this translation helpful? Give feedback.
-
|
Copying the files is usually easier to avoid any issues when links are used. Some software needs restarting to follow the new link to the real file contents but also the software probably keeps the file contents in memory anyway so might not be able to avoid restarting. The automated certificates as usually replaced a month before they expire so either way the workers need restarting every few months. What you've done below sounds like it will make sense, I guess you have to set a reminder in your calendar to check in in 2.5 months and see what certificate Postal is using. |
Beta Was this translation helpful? Give feedback.
-
|
while we maybe work out a better method here is a little guide on how to copy and keep certificates up to date. Monitoring and Updating Postal Certificates1. Install inotify-toolsInstall the toolset which provides sudo apt-get update
sudo apt-get install inotify-tools2. Create the Monitoring ScriptMake a script named nano /opt/postal/monitor_certs.shInsert the following code: #!/bin/bash
CERT_DIR="/opt/postal/caddy-data/caddy/certificates/acme.zerossl.com-v2-dv90/YOURDOMAIN/"
CERT_FILE="${CERT_DIR}YOURDOMAIN.crt"
KEY_FILE="${CERT_DIR}YOURDOMAIN.key"
while true; do
inotifywait -e modify "$CERT_FILE" "$KEY_FILE"
# Copy the certificates to Postal's configuration directory
cp "$CERT_FILE" /opt/postal/config/smtp.crt
cp "$KEY_FILE" /opt/postal/config/smtp.key
# Adjust permissions to ensure Postal can read the certificates
chmod o+r /opt/postal/config/smtp.*
# Restart Postal to use the new certificates
postal stop && sleep 15 && postal start
doneMake the script executable: chmod +x /opt/postal/monitor_certs.sh3. Create a systemd ServiceMake a systemd service file: sudo nano /etc/systemd/system/monitor_certs.serviceInsert the following content: [Unit]
Description=Monitor Caddy Certificates for Postal
[Service]
ExecStart=/opt/postal/monitor_certs.sh
Restart=always
User=your_username
Group=your_groupname
[Install]
WantedBy=multi-user.target4. Activate the ServiceReload the systemd daemons: sudo systemctl daemon-reloadEnable and start the service: sudo systemctl enable monitor_certs.service
sudo systemctl start monitor_certs.service5. Initial Manual Certificate CopyBefore the monitoring script takes over, you should manually copy the certificates for the first time: cp /opt/postal/caddy-data/caddy/certificates/acme.zerossl.com-v2-dv90/YOURDOMAIN/YOURDOMAIN.crt /opt/postal/config/smtp.crt
cp /opt/postal/caddy-data/caddy/certificates/acme.zerossl.com-v2-dv90/YOURDOMAIN/YOURDOMAIN.key /opt/postal/config/smtp.key
chmod o+r /opt/postal/config/smtp.*6. Test the TLS ConnectionTo ensure everything is working correctly, test the TLS connection with openssl s_client -connect YOURDOMAIN:YOURPORT-starttls smtp |
Beta Was this translation helpful? Give feedback.
-
|
That's what I pretty much figured. I did update the folders accordingly, but wasn't sure if there was something more complex I should consider. I guess we'll see how well it works in 90 days :) |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the howto. Can you please explain where i can find my group name? And also the username. Username i guess is the email for login into postal dashboard? |
Beta Was this translation helpful? Give feedback.
-
|
@vaztimur the 2 names are related to the username and group name of the server like root or another users |
Beta Was this translation helpful? Give feedback.
-
|
thank a lot for quick reply. Is it mandatory? or i can let it empty? |
Beta Was this translation helpful? Give feedback.
-
I have followed the above but for some reason once implementing these changes as well as changing the SMTP port from 25 to 465 I am getting an error 502 and can no longer access the web interface. Any ideas as to what is going on here and why this is happening? |
Beta Was this translation helpful? Give feedback.
-
|
On this line:
there is a issue it should be:
with a break after :PORT since otherwise wont work. |
Beta Was this translation helpful? Give feedback.
-
|
Hi all. With my purchased certificate, however, everything works correctly. |
Beta Was this translation helpful? Give feedback.
while we maybe work out a better method here is a little guide on how to copy and keep certificates up to date.
Monitoring and Updating Postal Certificates
1. Install inotify-tools
Install the toolset which provides
inotifywait, used to monitor certificate changes.2. Create the Monitoring Script
Make a script named
monitor_certs.sh:Insert the following code: