Admins

nginx-light et dehydrated installés sur mail, conf basique ajoutée :

server {
        listen 80;
        listen [::]:80;

        server_name mail.april.org imap.april.org smtp.april.org;

        location / {
                deny all;
        }
        location /.well-known/acme-challenge {
                alias /var/lib/dehydrated/acme-challenges;
        }
}

proxypass ajouté identique sur bastion.

Conf de postfix et dovecot modifée :

(April) root@mail:/etc/dovecot[master*+$]# git diff .
diff --git a/dovecot/dovecot.conf b/dovecot/dovecot.conf
index 83dfa86..161e7b9 100644
--- a/dovecot/dovecot.conf
+++ b/dovecot/dovecot.conf
@@ -24,9 +24,11 @@ plugin {
        sieve_global_path = /etc/dovecot/sieve/default.sieve
 }

-
-ssl_cert = </etc/ssl/certs/dovecot.pem
-ssl_key = </etc/ssl/private/dovecot.pem
+# old self signed cert
+#ssl_cert = </etc/ssl/certs/dovecot.pem
+#ssl_key = </etc/ssl/private/dovecot.pem
+ssl_cert = </var/lib/dehydrated/certs/mail.april.org/fullchain.pem
+ssl_key = </var/lib/dehydrated/certs/mail.april.org/privkey.pem

 protocols = imap pop3 sieve

(April) root@mail:/etc/postfix[master+$]# git diff --cached . 
diff --git a/postfix/conf.d/20-ssl.conf b/postfix/conf.d/20-ssl.conf
index 81ea48e..7a390d6 100644
--- a/postfix/conf.d/20-ssl.conf
+++ b/postfix/conf.d/20-ssl.conf
@@ -1,6 +1,9 @@
 # TLS parameters
-smtpd_tls_cert_file=/etc/postfix/ssl/certs/mail.april.org.pem
-smtpd_tls_key_file=/etc/postfix/ssl/private/mail.april.org.key
+# old selfsigned cert
+#smtpd_tls_cert_file=/etc/postfix/ssl/certs/mail.april.org.pem
+#smtpd_tls_key_file=/etc/postfix/ssl/private/mail.april.org.key
+smtpd_tls_cert_file=/var/lib/dehydrated/certs/mail.april.org/fullchain.pem
+smtpd_tls_key_file=/var/lib/dehydrated/certs/mail.april.org/privkey.pem
 smtpd_use_tls=yes
 smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
 smtpd_tls_received_header = yes
diff --git a/postfix/main.cf b/postfix/main.cf
index db12baa..32e6f43 100644
--- a/postfix/main.cf
+++ b/postfix/main.cf
@@ -37,8 +37,11 @@ mynetworks = 127.0.0.0/8 172.16.0.0/24 192.168.0.0/16 192.168.25.117/32 88.191.2
 ### conf.d/20-ssl.conf 

 # TLS parameters
-smtpd_tls_cert_file=/etc/postfix/ssl/certs/mail.april.org.pem
-smtpd_tls_key_file=/etc/postfix/ssl/private/mail.april.org.key
+#old selfsigned cert
+#smtpd_tls_cert_file=/etc/postfix/ssl/certs/mail.april.org.pem
+#smtpd_tls_key_file=/etc/postfix/ssl/private/mail.april.org.key
+smtpd_tls_cert_file=/var/lib/dehydrated/certs/mail.april.org/fullchain.pem
+smtpd_tls_key_file=/var/lib/dehydrated/certs/mail.april.org/privkey.pem
 smtpd_use_tls=yes
 smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
 smtpd_tls_received_header = yes

Cron rajouté pour charger les nouveaux cert.

Normalement tout est bon ! (vu avec etienne et gibus)

manque le monitoring smtps imaps

gibus | QGuLL: depuis la maison avec thunderbird 60.2.1 (qui buggait avant avec le cert autosigné) je te confirme que ça va très bien (en pop ici)