Just a quick question/answer pair to share what I've learned this morning.
Gmail marks self-signed certs for TLS as unencrypted in their interface now. This is obviously wrong. How has anyone else got around this?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Turns out there's a quick fix if you run your own mail server, and possibly web server alongside - use your letsencrypt certs. In
smtpd_tls_cert_file = /etc/letsencrypt/live/domain.com/fullchain.pem smtpd_tls_key_file = /etc/letsencrypt/live/domain.com/privkey.pem smtp_tls_cert_file = /etc/letsencrypt/live/domain.com/fullchain.pem smtp_tls_key_file = /etc/letsencrypt/live/domain.com/privkey.pem
Not sure of the difference between enabling it for smtpd only (does that cover send/receive? A topic for another question...) but both are there to be sure, anyway.
I also updated the LE script to reload postfix when certs were renewed:
web_service2='postfix' /usr/sbin/service $web_service2 reload
Added those lines to
/usr/local/sbin/le-renew-webroot-SITE which runs on a cron job.