Just a quick question/answer pair to share what I've learned this morning.
Gmail marks self-signed certs for TLS as unencrypted in their interface now. This is obviously wrong. How has anyone else got around this?
Just a quick question/answer pair to share what I've learned this morning.
Gmail marks self-signed certs for TLS as unencrypted in their interface now. This is obviously wrong. How has anyone else got around this?
Turns out there's a quick fix if you run your own mail server, and possibly web server alongside - use your letsencrypt certs. In /etc/postfix/main.cf
:
smtpd_tls_cert_file = /etc/letsencrypt/live/domain.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/domain.com/privkey.pem
smtp_tls_cert_file = /etc/letsencrypt/live/domain.com/fullchain.pem
smtp_tls_key_file = /etc/letsencrypt/live/domain.com/privkey.pem
Not sure of the difference between enabling it for smtpd only (does that cover send/receive? A topic for another question...) but both are there to be sure, anyway.
I also updated the LE script to reload postfix when certs were renewed:
web_service2='postfix'
/usr/sbin/service $web_service2 reload
Added those lines to /usr/local/sbin/le-renew-webroot-SITE
which runs on a cron job.
/etc/dovecot/conf.d/10-ssl.conf
as well, but you don't need to to get rid of the red padlock in Gmail.