Public » Linux

apt -y update; \
apt-get install -y certbot python3-certbot-apache; \
systemctl restart apache2; \
certbot -m webmaster@justnet.pl --agree-tos; \
systemctl restart apache2;

# kiedyś było wymagane:
#echo -e "<Directory /var/lib/letsencrypt/http_challenges/>\n\tOrder allow,deny\n\t\tallow from all\n\tRequire all granted\n</Directory>" > /etc/apache2/conf-available/lestencrypt.conf; \
#ln -s /etc/apache2/conf-available/lestencrypt.conf /etc/apache2/conf-enabled/lestencrypt.conf; \

Dla vhost odpowiedzialnego za webmail generujemy subdomeny smtp, pop, pop3, imap itp poprzez dodanie w vhost aliasów

ServerAlias smtp.justnet.pl
ServerAlias pop.justnet.pl
ServerAlias pop3.justnet.pl
ServerAlias imap.justnet.pl

Rozszerzamy aktualne certyfikaty wydając komendę certbot --apache i wybierając opcje Expand

Dodanie certyfikatów dla Dovecot w pliku /etc/dovecot/conf.d/10-ssl.conf, zmieniamy:

ssl_cert = </etc/ssl/certs/ssl-cert-snakeoil.pem
ssl_key = </etc/ssl/private/ssl-cert-snakeoil.key

na (przykład dla domeny justnet.pl)

ssl_cert = </etc/letsencrypt/live/mail.justnet.pl/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.justnet.pl/privkey.pem

Uprawnienia dla Dovecot:

chmod -cR 711 /etc/letsencrypt/live
echo '0 4 1 * * root /etc/init.d/dovecot restart' > /etc/cron.d/certbot

global
  log /dev/log    local0
  log /dev/log    local1 notice

  chroot /var/lib/haproxy
  stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
  stats timeout 30s
  user haproxy
  group haproxy
  daemon

  # Default SSL material locations
  ca-base /etc/ssl/certs
  crt-base /etc/ssl/private

  ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
  ssl-default-bind-options no-sslv3

defaults
  log     global
  mode    http
  option  httplog
  option  dontlognull
  timeout connect 5000
  timeout client  50000
  timeout server  50000
  errorfile 400 /etc/haproxy/errors/400.http
  errorfile 403 /etc/haproxy/errors/403.http
  errorfile 408 /etc/haproxy/errors/408.http
  errorfile 500 /etc/haproxy/errors/500.http
  errorfile 502 /etc/haproxy/errors/502.http
  errorfile 503 /etc/haproxy/errors/503.http
  errorfile 504 /etc/haproxy/errors/504.http

frontend http-in
  bind :80
  #bind :443 ssl crt /etc/letsencrypt/live/fullchains/cert.pem
  mode http

  # Strip port from Host header
  http-request replace-value Host (.*):.* \1

  acl is_letsencrypt-acl path_beg /.well-known/acme-challenge/
  use_backend letsencrypt-backend if is_letsencrypt-acl

backend letsencrypt-backend
  server letsencrypt 127.0.0.1:8888

certbot certonly --standalone --preferred-challenges http-01 --http-01-port 8888 --http-01-address 127.0.0.1 -d domain1.xyz -d domain1.xyz 

Podajemy port 8888 na którym słucha certbot, na port 8888 zostanie przekierowane zapytanie przez HAProxy z portu 80