ispmail-workaround-org/dist/ispmail-bookworm/creating-a-tls-encryption-key-and-certificate/index.html
forgejo-actions[bot] 1d0dd013b0 Update dist for stage
2026-01-18 17:38:37 +00:00

292 lines
No EOL
96 KiB
HTML
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

<!DOCTYPE html><html lang="en" dir="ltr" data-theme="dark" data-has-toc data-has-sidebar class="astro-bguv2lll"> <head><meta charset="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><title>TLS certificate | ISPmail Guide</title><link rel="canonical" href="https://workaround.org/ispmail-bookworm/creating-a-tls-encryption-key-and-certificate/"/><link rel="sitemap" href="/sitemap-index.xml"/><script src="https://rybbit.workaround.org/api/script.js" data-site-id="1" async defer></script><link rel="shortcut icon" href="/favicon.svg" type="image/svg+xml"/><meta name="generator" content="Astro v5.16.6"/><meta name="generator" content="Starlight v0.35.3"/><meta property="og:title" content="TLS certificate"/><meta property="og:type" content="article"/><meta property="og:url" content="https://workaround.org/ispmail-bookworm/creating-a-tls-encryption-key-and-certificate/"/><meta property="og:locale" content="en"/><meta property="og:description"/><meta property="og:site_name" content="ISPmail Guide"/><meta name="twitter:card" content="summary_large_image"/><script>
window.StarlightThemeProvider = (() => {
const storedTheme =
typeof localStorage !== 'undefined' && localStorage.getItem('starlight-theme');
const theme =
storedTheme ||
(window.matchMedia('(prefers-color-scheme: light)').matches ? 'light' : 'dark');
document.documentElement.dataset.theme = theme === 'light' ? 'light' : 'dark';
return {
updatePickers(theme = storedTheme || 'auto') {
document.querySelectorAll('starlight-theme-select').forEach((picker) => {
const select = picker.querySelector('select');
if (select) select.value = theme;
/** @type {HTMLTemplateElement | null} */
const tmpl = document.querySelector(`#theme-icons`);
const newIcon = tmpl && tmpl.content.querySelector('.' + theme);
if (newIcon) {
const oldIcon = picker.querySelector('svg.label-icon');
if (oldIcon) {
oldIcon.replaceChildren(...newIcon.cloneNode(true).childNodes);
}
}
});
},
};
})();
</script><template id="theme-icons"><svg aria-hidden="true" class="light astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M5 12a1 1 0 0 0-1-1H3a1 1 0 0 0 0 2h1a1 1 0 0 0 1-1Zm.64 5-.71.71a1 1 0 0 0 0 1.41 1 1 0 0 0 1.41 0l.71-.71A1 1 0 0 0 5.64 17ZM12 5a1 1 0 0 0 1-1V3a1 1 0 0 0-2 0v1a1 1 0 0 0 1 1Zm5.66 2.34a1 1 0 0 0 .7-.29l.71-.71a1 1 0 1 0-1.41-1.41l-.66.71a1 1 0 0 0 0 1.41 1 1 0 0 0 .66.29Zm-12-.29a1 1 0 0 0 1.41 0 1 1 0 0 0 0-1.41l-.71-.71a1.004 1.004 0 1 0-1.43 1.41l.73.71ZM21 11h-1a1 1 0 0 0 0 2h1a1 1 0 0 0 0-2Zm-2.64 6A1 1 0 0 0 17 18.36l.71.71a1 1 0 0 0 1.41 0 1 1 0 0 0 0-1.41l-.76-.66ZM12 6.5a5.5 5.5 0 1 0 5.5 5.5A5.51 5.51 0 0 0 12 6.5Zm0 9a3.5 3.5 0 1 1 0-7 3.5 3.5 0 0 1 0 7Zm0 3.5a1 1 0 0 0-1 1v1a1 1 0 0 0 2 0v-1a1 1 0 0 0-1-1Z"/></svg><svg aria-hidden="true" class="dark astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21.64 13a1 1 0 0 0-1.05-.14 8.049 8.049 0 0 1-3.37.73 8.15 8.15 0 0 1-8.14-8.1 8.59 8.59 0 0 1 .25-2A1 1 0 0 0 8 2.36a10.14 10.14 0 1 0 14 11.69 1 1 0 0 0-.36-1.05Zm-9.5 6.69A8.14 8.14 0 0 1 7.08 5.22v.27a10.15 10.15 0 0 0 10.14 10.14 9.784 9.784 0 0 0 2.1-.22 8.11 8.11 0 0 1-7.18 4.32v-.04Z"/></svg><svg aria-hidden="true" class="auto astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21 14h-1V7a3 3 0 0 0-3-3H7a3 3 0 0 0-3 3v7H3a1 1 0 0 0-1 1v2a3 3 0 0 0 3 3h14a3 3 0 0 0 3-3v-2a1 1 0 0 0-1-1ZM6 7a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1v7H6V7Zm14 10a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1v-1h16v1Z"/></svg></template><link rel="stylesheet" href="/_astro/print.DNXP8c50.css" media="print"><link rel="stylesheet" href="/_astro/index.DpSp7KkT.css">
<style>@layer starlight.components{:root{--sl-badge-default-border: var(--sl-color-accent);--sl-badge-default-bg: var(--sl-color-accent-low);--sl-badge-default-text: #fff;--sl-badge-note-border: var(--sl-color-blue);--sl-badge-note-bg: var(--sl-color-blue-low);--sl-badge-note-text: #fff;--sl-badge-danger-border: var(--sl-color-red);--sl-badge-danger-bg: var(--sl-color-red-low);--sl-badge-danger-text: #fff;--sl-badge-success-border: var(--sl-color-green);--sl-badge-success-bg: var(--sl-color-green-low);--sl-badge-success-text: #fff;--sl-badge-caution-border: var(--sl-color-orange);--sl-badge-caution-bg: var(--sl-color-orange-low);--sl-badge-caution-text: #fff;--sl-badge-tip-border: var(--sl-color-purple);--sl-badge-tip-bg: var(--sl-color-purple-low);--sl-badge-tip-text: #fff}[data-theme=light]:root{--sl-badge-default-bg: var(--sl-color-accent-high);--sl-badge-note-bg: var(--sl-color-blue-high);--sl-badge-danger-bg: var(--sl-color-red-high);--sl-badge-success-bg: var(--sl-color-green-high);--sl-badge-caution-bg: var(--sl-color-orange-high);--sl-badge-tip-bg: var(--sl-color-purple-high)}.sl-badge:where(.astro-avdet4wd){display:inline-block;border:1px solid var(--sl-color-border-badge);border-radius:.25rem;font-family:var(--sl-font-system-mono);line-height:normal;color:var(--sl-color-text-badge);background-color:var(--sl-color-bg-badge);overflow-wrap:anywhere}.sidebar-content .sl-badge:where(.astro-avdet4wd){line-height:1;font-size:var(--sl-text-xs);padding:.125rem .375rem}.sidebar-content a[aria-current=page]>.sl-badge:where(.astro-avdet4wd){--sl-color-bg-badge: transparent;--sl-color-border-badge: currentColor;color:inherit}.default:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-default-bg);--sl-color-border-badge: var(--sl-badge-default-border);--sl-color-text-badge: var(--sl-badge-default-text)}.note:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-note-bg);--sl-color-border-badge: var(--sl-badge-note-border);--sl-color-text-badge: var(--sl-badge-note-text)}.danger:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-danger-bg);--sl-color-border-badge: var(--sl-badge-danger-border);--sl-color-text-badge: var(--sl-badge-danger-text)}.success:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-success-bg);--sl-color-border-badge: var(--sl-badge-success-border);--sl-color-text-badge: var(--sl-badge-success-text)}.tip:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-tip-bg);--sl-color-border-badge: var(--sl-badge-tip-border);--sl-color-text-badge: var(--sl-badge-tip-text)}.caution:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-caution-bg);--sl-color-border-badge: var(--sl-badge-caution-border);--sl-color-text-badge: var(--sl-badge-caution-text)}.small:where(.astro-avdet4wd){font-size:var(--sl-text-xs);padding:.125rem .25rem}.medium:where(.astro-avdet4wd){font-size:var(--sl-text-sm);padding:.175rem .35rem}.large:where(.astro-avdet4wd){font-size:var(--sl-text-base);padding:.225rem .45rem}.sl-markdown-content :is(h1,h2,h3,h4,h5,h6) .sl-badge:where(.astro-avdet4wd){vertical-align:middle}}
@layer starlight.components{.card-grid:where(.astro-zntqmydn){display:grid;grid-template-columns:100%;gap:1rem}.card-grid:where(.astro-zntqmydn)>*{margin-top:0!important}@media(min-width:50rem){.card-grid:where(.astro-zntqmydn){grid-template-columns:1fr 1fr;gap:1.5rem}.stagger:where(.astro-zntqmydn){--stagger-height: 5rem;padding-bottom:var(--stagger-height)}.stagger:where(.astro-zntqmydn)>*:nth-child(2n){transform:translateY(var(--stagger-height))}}}
@layer starlight.components{.card:where(.astro-v5tidmuc){--sl-card-border: var(--sl-color-purple);--sl-card-bg: var(--sl-color-purple-low);border:1px solid var(--sl-color-gray-5);background-color:var(--sl-color-black);padding:clamp(1rem,calc(.125rem + 3vw),2.5rem);flex-direction:column;gap:clamp(.5rem,calc(.125rem + 1vw),1rem)}.card:where(.astro-v5tidmuc):nth-child(4n+1){--sl-card-border: var(--sl-color-orange);--sl-card-bg: var(--sl-color-orange-low)}.card:where(.astro-v5tidmuc):nth-child(4n+3){--sl-card-border: var(--sl-color-green);--sl-card-bg: var(--sl-color-green-low)}.card:where(.astro-v5tidmuc):nth-child(4n+4){--sl-card-border: var(--sl-color-red);--sl-card-bg: var(--sl-color-red-low)}.card:where(.astro-v5tidmuc):nth-child(4n+5){--sl-card-border: var(--sl-color-blue);--sl-card-bg: var(--sl-color-blue-low)}.title:where(.astro-v5tidmuc){font-weight:600;font-size:var(--sl-text-h4);color:var(--sl-color-white);line-height:var(--sl-line-height-headings);gap:1rem;align-items:center}.card:where(.astro-v5tidmuc) .icon:where(.astro-v5tidmuc){border:1px solid var(--sl-card-border);background-color:var(--sl-card-bg);padding:.2em;border-radius:.25rem;flex-shrink:0}.card:where(.astro-v5tidmuc) .body:where(.astro-v5tidmuc){margin:0;font-size:clamp(var(--sl-text-sm),calc(.5rem + 1vw),var(--sl-text-body))}}
@layer starlight.components{svg:where(.astro-c6vsoqas){color:var(--sl-icon-color);font-size:var(--sl-icon-size, 1em);width:1em;height:1em}}
@layer starlight.components{starlight-tabs:where(.astro-esqgolmp){display:block}.tablist-wrapper:where(.astro-esqgolmp){overflow-x:auto}:where(.astro-esqgolmp)[role=tablist]{display:flex;list-style:none;border-bottom:2px solid var(--sl-color-gray-5);padding:0}.tab:where(.astro-esqgolmp){margin-bottom:-2px}.tab:where(.astro-esqgolmp)>:where(.astro-esqgolmp)[role=tab]{display:flex;align-items:center;gap:.5rem;padding:0 1.25rem;text-decoration:none;border-bottom:2px solid var(--sl-color-gray-5);color:var(--sl-color-gray-3);outline-offset:var(--sl-outline-offset-inside);overflow-wrap:initial}.tab:where(.astro-esqgolmp) :where(.astro-esqgolmp)[role=tab][aria-selected=true]{color:var(--sl-color-white);border-color:var(--sl-color-text-accent);font-weight:600}.tablist-wrapper:where(.astro-esqgolmp)~[role=tabpanel]{margin-top:1rem}}
@layer starlight.components{.sl-steps{--bullet-size: calc(var(--sl-line-height) * 1rem);--bullet-margin: .375rem;list-style:none;counter-reset:steps-counter var(--sl-steps-start, 0);padding-inline-start:0}.sl-steps>li{counter-increment:steps-counter;position:relative;padding-inline-start:calc(var(--bullet-size) + 1rem);padding-bottom:1px;min-height:calc(var(--bullet-size) + var(--bullet-margin))}.sl-steps>li+li{margin-top:0}.sl-steps>li:before{content:counter(steps-counter);position:absolute;top:0;inset-inline-start:0;width:var(--bullet-size);height:var(--bullet-size);line-height:var(--bullet-size);font-size:var(--sl-text-xs);font-weight:600;text-align:center;color:var(--sl-color-white);background-color:var(--sl-color-gray-6);border-radius:99rem;box-shadow:inset 0 0 0 1px var(--sl-color-gray-5)}.sl-steps>li:after{--guide-width: 1px;content:"";position:absolute;top:calc(var(--bullet-size) + var(--bullet-margin));bottom:var(--bullet-margin);inset-inline-start:calc((var(--bullet-size) - var(--guide-width)) / 2);width:var(--guide-width);background-color:var(--sl-color-hairline-light)}}@layer starlight.content{.sl-steps>li>:first-child{--lh: calc(1em * var(--sl-line-height));--shift-y: calc(.5 * (var(--bullet-size) - var(--lh)));transform:translateY(var(--shift-y));margin-bottom:var(--shift-y)}.sl-steps>li>:first-child:where(h1,h2,h3,h4,h5,h6){--lh: calc(1em * var(--sl-line-height-headings))}@supports (--prop: 1lh){.sl-steps>li>:first-child{--lh: 1lh}}}
@layer starlight.components{starlight-file-tree:where(.astro-p67cqifm){--x-space: 1.5rem;--y-space: .125rem;--y-pad: 0;display:block;border:1px solid var(--sl-color-gray-5);padding:1rem;background-color:var(--sl-color-gray-6);font-size:var(--sl-text-xs);font-family:var(--__sl-font-mono);overflow-x:auto}starlight-file-tree:where(.astro-p67cqifm) .directory>details{border:0;padding:0;padding-inline-start:var(--x-space);background:transparent}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary{margin-inline-start:calc(-1 * var(--x-space));border:0;padding:var(--y-pad) .625rem;font-weight:400;color:var(--sl-color-white);max-width:100%}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary::marker,starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary::-webkit-details-marker{color:var(--sl-color-gray-3)}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary:hover,starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary:hover .tree-icon{cursor:pointer;color:var(--sl-color-text-accent);fill:currentColor}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary:hover~ul{border-color:var(--sl-color-gray-4)}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary:hover .highlight .tree-icon{color:var(--sl-color-text-invert);fill:currentColor}starlight-file-tree:where(.astro-p67cqifm) ul{margin-inline-start:.5rem;border-inline-start:1px solid var(--sl-color-gray-5);padding:0;padding-inline-start:.125rem;list-style:none}starlight-file-tree:where(.astro-p67cqifm)>ul{margin:0;border:0;padding:0}starlight-file-tree:where(.astro-p67cqifm) li{margin:var(--y-space) 0;padding:var(--y-pad) 0}starlight-file-tree:where(.astro-p67cqifm) .file{margin-inline-start:calc(var(--x-space) - .125rem);color:var(--sl-color-white)}starlight-file-tree:where(.astro-p67cqifm) .tree-entry{display:inline-flex;align-items:flex-start;flex-wrap:wrap;max-width:calc(100% - 1rem)}@media(min-width:30em){starlight-file-tree:where(.astro-p67cqifm) .tree-entry{flex-wrap:nowrap}}starlight-file-tree:where(.astro-p67cqifm) .tree-entry>:first-child{flex-shrink:0}starlight-file-tree:where(.astro-p67cqifm) .empty{color:var(--sl-color-gray-3);padding-inline-start:.375rem}starlight-file-tree:where(.astro-p67cqifm) .comment{color:var(--sl-color-gray-3);padding-inline-start:1.625rem;max-width:24rem;min-width:12rem}starlight-file-tree:where(.astro-p67cqifm) .highlight{display:inline-block;border-radius:.25rem;padding-inline-end:.5rem;color:var(--sl-color-text-invert);background-color:var(--sl-color-text-accent)}starlight-file-tree:where(.astro-p67cqifm) svg{display:inline;fill:var(--sl-color-gray-3);vertical-align:middle;margin-inline:.25rem .375rem;width:.875rem;height:.875rem}starlight-file-tree:where(.astro-p67cqifm) .highlight svg.tree-icon{fill:currentColor}}
@layer starlight.components{.sl-link-button:where(.astro-xwgiixxa){align-items:center;border:1px solid transparent;border-radius:999rem;display:inline-flex;font-size:var(--sl-text-sm);gap:.5em;line-height:1.1875;outline-offset:.25rem;padding:.4375rem 1.125rem;text-decoration:none}.sl-link-button:where(.astro-xwgiixxa).primary{background:var(--sl-color-text-accent);border-color:var(--sl-color-text-accent);color:var(--sl-color-black)}.sl-link-button:where(.astro-xwgiixxa).primary:hover{color:var(--sl-color-black)}.sl-link-button:where(.astro-xwgiixxa).secondary{border-color:inherit;color:var(--sl-color-white)}.sl-link-button:where(.astro-xwgiixxa).minimal{color:var(--sl-color-white);padding-inline:0}.sl-link-button:where(.astro-xwgiixxa) svg{flex-shrink:0}@media(min-width:50rem){.sl-link-button:where(.astro-xwgiixxa){font-size:var(--sl-text-base);padding:.9375rem 1.25rem}}.sl-markdown-content .sl-link-button:where(.astro-xwgiixxa){margin-inline-end:1rem}.sl-markdown-content .sl-link-button:where(.astro-xwgiixxa):not(:where(p *)){margin-block:1rem}}
</style><script type="module" src="/_astro/page.B1D-nYk3.js"></script></head> <body class="astro-bguv2lll"> <a href="#_top" class="astro-7q3lir66">Skip to content</a> <div class="page sl-flex astro-vrdttmbt"> <header class="header astro-vrdttmbt"><div class="header astro-kmkmnagf"> <div class="title-wrapper sl-flex astro-kmkmnagf"> <a href="/" class="site-title sl-flex astro-m46x6ez3"> <img class="light:sl-hidden print:hidden astro-m46x6ez3" alt src="/_astro/logo-dark.DlBk_-6-.svg" width="146" height="37"> <img class="dark:sl-hidden print:block astro-m46x6ez3" alt src="/_astro/logo.DfR9nmxN.svg" width="146" height="37"> <span class="sr-only astro-m46x6ez3" translate="no"> ISPmail Guide </span> </a> </div> <div class="sl-flex print:hidden astro-kmkmnagf"> <site-search class="astro-kmkmnagf astro-v37mnknz" data-translations="{&#34;placeholder&#34;:&#34;Search&#34;}"> <button data-open-modal disabled aria-label="Search" aria-keyshortcuts="Control+K" class="astro-v37mnknz"> <svg aria-hidden="true" class="astro-v37mnknz astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21.71 20.29 18 16.61A9 9 0 1 0 16.61 18l3.68 3.68a.999.999 0 0 0 1.42 0 1 1 0 0 0 0-1.39ZM11 18a7 7 0 1 1 0-14 7 7 0 0 1 0 14Z"/></svg> <span class="sl-hidden md:sl-block astro-v37mnknz" aria-hidden="true">Search</span> <kbd class="sl-hidden md:sl-flex astro-v37mnknz" style="display: none;"> <kbd class="astro-v37mnknz">Ctrl</kbd><kbd class="astro-v37mnknz">K</kbd> </kbd> </button> <dialog style="padding:0" aria-label="Search" class="astro-v37mnknz"> <div class="dialog-frame sl-flex astro-v37mnknz"> <button data-close-modal class="sl-flex md:sl-hidden astro-v37mnknz"> Cancel </button> <div class="search-container astro-v37mnknz"> <div id="starlight__search" class="astro-v37mnknz"></div> </div> </div> </dialog> </site-search> <script>
(() => {
const openBtn = document.querySelector('button[data-open-modal]');
const shortcut = openBtn?.querySelector('kbd');
if (!openBtn || !(shortcut instanceof HTMLElement)) return;
const platformKey = shortcut.querySelector('kbd');
if (platformKey && /(Mac|iPhone|iPod|iPad)/i.test(navigator.platform)) {
platformKey.textContent = '⌘';
openBtn.setAttribute('aria-keyshortcuts', 'Meta+K');
}
shortcut.style.display = '';
})();
</script> <script type="module" src="/_astro/Search.astro_astro_type_script_index_0_lang.cjYDvRdi.js"></script> </div> <div class="sl-hidden md:sl-flex print:hidden right-group astro-kmkmnagf"> <div class="sl-flex social-icons astro-kmkmnagf"> <a href="https://git.workaround.org/chaas/ispmail-workaround-org" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Git</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M0.355 12.231L0.355 12.231L0.355 11.853Q0.397 11.517 0.565 11.265L0.565 11.265Q0.691 11.097 0.943 10.803L0.943 10.803L1.279 10.425L7.831 3.831L7.873 3.873Q7.957 3.873 7.957 3.957L7.957 3.957L10.309 6.351Q10.519 6.519 10.309 6.729L10.309 6.729Q10.225 7.317 10.435 7.863Q10.645 8.409 11.107 8.703L11.107 8.703Q11.275 8.787 11.317 8.892Q11.359 8.997 11.359 9.207L11.359 9.207L11.359 15.003Q11.359 15.255 11.107 15.507L11.107 15.507Q10.603 15.843 10.372 16.389Q10.141 16.935 10.330 17.502Q10.519 18.069 10.981 18.447Q11.443 18.825 12.031 18.825Q12.619 18.825 13.081 18.489Q13.543 18.153 13.732 17.586Q13.921 17.019 13.753 16.473Q13.585 15.927 13.081 15.507L13.081 15.507Q12.913 15.423 12.871 15.318Q12.829 15.213 12.829 15.003L12.829 15.003L12.829 9.081L12.955 9.081L15.055 11.181Q15.139 11.265 15.139 11.391L15.139 11.391L15.181 11.475L15.181 12.231Q15.265 13.029 15.874 13.470Q16.483 13.911 17.281 13.806Q18.079 13.701 18.562 13.029Q19.045 12.357 18.835 11.601L18.835 11.601Q18.751 10.929 18.100 10.488Q17.449 10.047 16.735 10.131L16.735 10.131Q16.483 10.131 16.231 10.005L16.231 10.005L14.005 7.779Q13.879 7.653 13.879 7.401L13.879 7.401Q14.005 6.813 13.711 6.267Q13.417 5.721 12.871 5.448Q12.325 5.175 11.779 5.301L11.779 5.301Q11.359 5.301 11.359 5.175L11.359 5.175Q9.805 3.579 9.007 2.907L9.007 2.907Q8.797 2.739 9.007 2.529L9.007 2.529Q9.469 2.193 10.183 1.353L10.183 1.353L10.729 0.807Q11.905-0.369 13.081 0.807L13.081 0.807L23.035 10.803Q24.253 11.979 23.035 13.155L23.035 13.155L13.291 22.941Q12.913 23.319 12.745 23.445L12.745 23.445Q12.409 23.739 12.031 23.781L12.031 23.781L11.779 23.781L11.569 23.697Q11.065 23.487 10.855 23.277L10.855 23.277L10.057 22.479Q8.881 21.387 8.335 20.757L8.335 20.757L1.153 13.575Q1.069 13.365 0.775 13.029L0.775 13.029Q0.397 12.525 0.355 12.231Z"/></svg></a><a href="https://riot.im/app/#/room/#ispmail:matrix.org" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Matrix</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M22.5 1.5v21h-2.25V24H24V0h-3.75v1.5h2.25ZM7.46 7.95V9.1h.04a3.02 3.02 0 0 1 2.61-1.39c.54 0 1.03.1 1.48.32.44.2.78.58 1.01 1.1.26-.37.6-.7 1.03-.99.44-.28.95-.43 1.55-.43.45 0 .87.06 1.26.17.38.11.71.29.99.53.27.24.49.56.64.95.15.4.23.86.23 1.42v5.72h-2.34v-4.85c0-.29-.01-.56-.04-.8a1.73 1.73 0 0 0-.18-.67 1.1 1.1 0 0 0-.44-.45 1.6 1.6 0 0 0-.78-.16c-.33 0-.6.06-.8.19-.2.12-.37.29-.48.5a2 2 0 0 0-.23.69c-.04.26-.06.52-.06.78v4.77H10.6v-4.8l-.01-.75a2.29 2.29 0 0 0-.14-.69c-.08-.2-.23-.38-.42-.5a1.5 1.5 0 0 0-.85-.2c-.15.01-.3.04-.44.08-.19.06-.37.15-.52.28-.18.14-.32.34-.44.6-.12.26-.18.6-.18 1.02v4.96H5.25V7.94h2.21ZM1.5 1.5v21h2.25V24H0V0h3.75v1.5H1.5Z"/></svg></a><a href="https://comentario.workaround.org/api/rss/comments?domain=0f111a27-fbfa-48af-8beb-ab12e612d92f" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Feed</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M2.88 16.88a3 3 0 0 0 0 4.24 3 3 0 0 0 4.24 0 3 3 0 0 0-4.24-4.24Zm2.83 2.83a1 1 0 0 1-1.42-1.42 1 1 0 0 1 1.42 0 1 1 0 0 1 0 1.42ZM5 12a1 1 0 0 0 0 2 5 5 0 0 1 5 5 1 1 0 0 0 2 0 7 7 0 0 0-7-7Zm0-4a1 1 0 0 0 0 2 9 9 0 0 1 9 9 1 1 0 0 0 2 0 11.08 11.08 0 0 0-3.22-7.78A11.08 11.08 0 0 0 5 8Zm10.61.39A15.11 15.11 0 0 0 5 4a1 1 0 0 0 0 2 13 13 0 0 1 13 13 1 1 0 0 0 2 0 15.11 15.11 0 0 0-4.39-10.61Z"/></svg></a> </div> <starlight-theme-select> <label style="--sl-select-width: 6.25em" class="astro-4yphtoen"> <span class="sr-only astro-4yphtoen">Select theme</span> <svg aria-hidden="true" class="icon label-icon astro-4yphtoen astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21 14h-1V7a3 3 0 0 0-3-3H7a3 3 0 0 0-3 3v7H3a1 1 0 0 0-1 1v2a3 3 0 0 0 3 3h14a3 3 0 0 0 3-3v-2a1 1 0 0 0-1-1ZM6 7a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1v7H6V7Zm14 10a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1v-1h16v1Z"/></svg> <select autocomplete="off" class="astro-4yphtoen"> <option value="dark" class="astro-4yphtoen">Dark</option><option value="light" class="astro-4yphtoen">Light</option><option value="auto" selected class="astro-4yphtoen">Auto</option> </select> <svg aria-hidden="true" class="icon caret astro-4yphtoen astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M17 9.17a1 1 0 0 0-1.41 0L12 12.71 8.46 9.17a1 1 0 1 0-1.41 1.42l4.24 4.24a1.002 1.002 0 0 0 1.42 0L17 10.59a1.002 1.002 0 0 0 0-1.42Z"/></svg> </label> </starlight-theme-select> <script>
StarlightThemeProvider.updatePickers();
</script> <script type="module">const r="starlight-theme",o=e=>e==="auto"||e==="dark"||e==="light"?e:"auto",c=()=>o(typeof localStorage<"u"&&localStorage.getItem(r));function n(e){typeof localStorage<"u"&&localStorage.setItem(r,e==="light"||e==="dark"?e:"")}const l=()=>matchMedia("(prefers-color-scheme: light)").matches?"light":"dark";function t(e){StarlightThemeProvider.updatePickers(e),document.documentElement.dataset.theme=e==="auto"?l():e,n(e)}matchMedia("(prefers-color-scheme: light)").addEventListener("change",()=>{c()==="auto"&&t("auto")});class s extends HTMLElement{constructor(){super(),t(c()),this.querySelector("select")?.addEventListener("change",a=>{a.currentTarget instanceof HTMLSelectElement&&t(o(a.currentTarget.value))})}}customElements.define("starlight-theme-select",s);</script> <script type="module">class s extends HTMLElement{constructor(){super();const e=this.querySelector("select");e&&(e.addEventListener("change",t=>{t.currentTarget instanceof HTMLSelectElement&&(window.location.pathname=t.currentTarget.value)}),window.addEventListener("pageshow",t=>{if(!t.persisted)return;const n=e.querySelector("option[selected]")?.index;n!==e.selectedIndex&&(e.selectedIndex=n??0)}))}}customElements.define("starlight-lang-select",s);</script> </div> </div> </header> <nav class="sidebar print:hidden astro-vrdttmbt" aria-label="Main"> <starlight-menu-button class="print:hidden astro-jif73yzw"> <button aria-expanded="false" aria-label="Menu" aria-controls="starlight__sidebar" class="sl-flex md:sl-hidden astro-jif73yzw"> <svg aria-hidden="true" class="open-menu astro-jif73yzw astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M3 8h18a1 1 0 1 0 0-2H3a1 1 0 0 0 0 2Zm18 8H3a1 1 0 0 0 0 2h18a1 1 0 0 0 0-2Zm0-5H3a1 1 0 0 0 0 2h18a1 1 0 0 0 0-2Z"/></svg> <svg aria-hidden="true" class="close-menu astro-jif73yzw astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="m13.41 12 6.3-6.29a1.004 1.004 0 1 0-1.42-1.42L12 10.59l-6.29-6.3a1.004 1.004 0 0 0-1.42 1.42l6.3 6.29-6.3 6.29a1 1 0 0 0 0 1.42.998.998 0 0 0 1.42 0l6.29-6.3 6.29 6.3a.999.999 0 0 0 1.42 0 1 1 0 0 0 0-1.42L13.41 12Z"/></svg> </button> </starlight-menu-button> <script type="module">class s extends HTMLElement{constructor(){super(),this.btn=this.querySelector("button"),this.btn.addEventListener("click",()=>this.toggleExpanded());const t=this.closest("nav");t&&t.addEventListener("keyup",e=>this.closeOnEscape(e))}setExpanded(t){this.setAttribute("aria-expanded",String(t)),document.body.toggleAttribute("data-mobile-menu-expanded",t)}toggleExpanded(){this.setExpanded(this.getAttribute("aria-expanded")!=="true")}closeOnEscape(t){t.code==="Escape"&&(this.setExpanded(!1),this.btn.focus())}}customElements.define("starlight-menu-button",s);</script> <div id="starlight__sidebar" class="sidebar-pane astro-vrdttmbt"> <div class="sidebar-content sl-flex astro-vrdttmbt"> <sl-sidebar-state-persist data-hash="01h4vp7" class="astro-kku4brbg"> <script aria-hidden="true">
(() => {
try {
if (!matchMedia('(min-width: 50em)').matches) return;
/** @type {HTMLElement | null} */
const target = document.querySelector('sl-sidebar-state-persist');
const state = JSON.parse(sessionStorage.getItem('sl-sidebar-state') || '0');
if (!target || !state || target.dataset.hash !== state.hash) return;
window._starlightScrollRestore = state.scroll;
customElements.define(
'sl-sidebar-restore',
class SidebarRestore extends HTMLElement {
connectedCallback() {
try {
const idx = parseInt(this.dataset.index || '');
const details = this.closest('details');
if (details && typeof state.open[idx] === 'boolean') details.open = state.open[idx];
} catch {}
}
}
);
} catch {}
})();
</script> <ul class="top-level astro-3ii7xxms"> <li class="astro-3ii7xxms"> <details open class="astro-3ii7xxms"> <sl-sidebar-restore data-index="0"></sl-sidebar-restore> <summary class="astro-3ii7xxms"> <span class="group-label astro-3ii7xxms"> <span class="large astro-3ii7xxms">ISPmail for Debian 13</span> </span> <svg aria-hidden="true" class="caret astro-3ii7xxms astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.25rem;"><path d="m14.83 11.29-4.24-4.24a1 1 0 1 0-1.42 1.41L12.71 12l-3.54 3.54a1 1 0 0 0 0 1.41 1 1 0 0 0 .71.29 1 1 0 0 0 .71-.29l4.24-4.24a1.002 1.002 0 0 0 0-1.42Z"/></svg> </summary> <ul class="astro-3ii7xxms"> <li class="astro-3ii7xxms"> <a href="/ispmail-trixie/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Start here</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/upgrading/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Upgrading from Debian Bookworm</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/install-debian/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Installing Debian</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/install-the-software-packages/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Install software packages</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/virtual-domains/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Virtual domains</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/database/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Database setup</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/overview/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Big picture</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/dns-records/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">DNS records</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/tls-certificate/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">TLS certificate</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/postfix/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Postfix</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/dovecot/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Dovecot</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/lmtp/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">LMTP</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/webmail/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Webmail using Roundcube</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/relaying/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Sending / Relaying</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/imap/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">IMAP</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/managing-users-aliases-and-domains/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Managing users, aliases and domains</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/catching-spam-with-rspamd/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Catching spam with rspamd</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/anti-spoofing-dkim-spf/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Prevent spoofing using DKIM and SPF</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/catch-all/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Catch-all addresses</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/quotas/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Quotas</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/going-live/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Going live</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/automated-installation/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Automated installation</span> </a> </li> </ul> </details> </li><li class="astro-3ii7xxms"> <details open class="astro-3ii7xxms"> <sl-sidebar-restore data-index="1"></sl-sidebar-restore> <summary class="astro-3ii7xxms"> <span class="group-label astro-3ii7xxms"> <span class="large astro-3ii7xxms">ISPmail for Debian 12</span> </span> <svg aria-hidden="true" class="caret astro-3ii7xxms astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.25rem;"><path d="m14.83 11.29-4.24-4.24a1 1 0 1 0-1.42 1.41L12.71 12l-3.54 3.54a1 1 0 0 0 0 1.41 1 1 0 0 0 .71.29 1 1 0 0 0 .71-.29l4.24-4.24a1.002 1.002 0 0 0 0-1.42Z"/></svg> </summary> <ul class="astro-3ii7xxms"> <li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Start here</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/whats-new/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">What&#39;s new</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/migrating-from-a-bullseye-to-a-bookworm-server/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Migrating from your old (Bullseye) server</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/big-picture/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">The big picture</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/types-of-email-domains/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Types of email domains</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/install-debian-bookworm-on-your-server/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Installing Debian</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/install-the-software-packages/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Install software packages</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/creating-a-tls-encryption-key-and-certificate/" aria-current="page" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">TLS certificate</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/prepare-the-database/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Preparing the database</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/making-postfix-get-its-information-from-the-mariadb-database/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Let Postfix access MariaDB</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/catchall-aliases/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Catch-all aliases</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/setting-up-dovecot/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Setting up Dovecot</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/let-postfix-send-emails-to-dovecot/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Let Postfix send emails to Dovecot</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/quotas/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Quotas</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/testing-imap/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Testing IMAP</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/webmail-using-roundcube/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Webmail using Roundcube</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/testing-email-delivery/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Testing email delivery</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/relaying-outgoing-emails-through-postfix/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Relaying outgoing emails through Postfix</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/catching-spam-with-rspamd/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Catching spam with rspamd</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/setting-dns-records/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Setting DNS records</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/prevent-spoofing-using-dkim/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Prevent spoofing using DKIM</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/managing-users-aliases-and-domains/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Managing users, aliases and domains</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/monitoring-and-backup/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Monitoring and Backup</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/automatic-installation-with-ansible/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Automatic installation with Ansible</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/success-stories/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Success stories</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/faq-frequently-asked-questions/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">FAQ (frequently asked questions)</span> </a> </li> </ul> </details> </li><li class="astro-3ii7xxms"> <details open class="astro-3ii7xxms"> <sl-sidebar-restore data-index="2"></sl-sidebar-restore> <summary class="astro-3ii7xxms"> <span class="group-label astro-3ii7xxms"> <span class="large astro-3ii7xxms">Misc articles</span> </span> <svg aria-hidden="true" class="caret astro-3ii7xxms astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.25rem;"><path d="m14.83 11.29-4.24-4.24a1 1 0 1 0-1.42 1.41L12.71 12l-3.54 3.54a1 1 0 0 0 0 1.41 1 1 0 0 0 .71.29 1 1 0 0 0 .71-.29l4.24-4.24a1.002 1.002 0 0 0 0-1.42Z"/></svg> </summary> <ul class="astro-3ii7xxms"> <li class="astro-3ii7xxms"> <a href="/article/updating-the-bios-on-lenovo-laptops-from-linux-using-a-usb-flash-stick/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Updating the BIOS on Lenovo laptops from Linux using a USB flash stick</span> </a> </li><li class="astro-3ii7xxms"> <a href="/bacula-cheatsheet/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Bareos/Bacula Cheat Sheet</span> </a> </li><li class="astro-3ii7xxms"> <a href="/debian-packages-are-so-old/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Debian packages are so old</span> </a> </li><li class="astro-3ii7xxms"> <a href="/getting-help-on-irc/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Getting help on IRC</span> </a> </li><li class="astro-3ii7xxms"> <a href="/linux/renaming-multiple-files/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Renaming multiple files</span> </a> </li><li class="astro-3ii7xxms"> <a href="/linuxtip/pipes/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Pipes and redirection</span> </a> </li><li class="astro-3ii7xxms"> <a href="/rsnapshot-and-usb-drives/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Backups with rsnaphot to external USB drives</span> </a> </li><li class="astro-3ii7xxms"> <a href="/squid-acls/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">How Squid ACLs work</span> </a> </li><li class="astro-3ii7xxms"> <a href="/understanding-lvm/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Understanding the Logical Volume Manager (LVM)</span> </a> </li> </ul> </details> </li> </ul> <script aria-hidden="true">
(() => {
const scroller = document.getElementById('starlight__sidebar');
if (!window._starlightScrollRestore || !scroller) return;
scroller.scrollTop = window._starlightScrollRestore;
delete window._starlightScrollRestore;
})();
</script> </sl-sidebar-state-persist> <div class="md:sl-hidden"> <div class="mobile-preferences sl-flex astro-wu23bvmt"> <div class="social-icons astro-wu23bvmt"> <a href="https://git.workaround.org/chaas/ispmail-workaround-org" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Git</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M0.355 12.231L0.355 12.231L0.355 11.853Q0.397 11.517 0.565 11.265L0.565 11.265Q0.691 11.097 0.943 10.803L0.943 10.803L1.279 10.425L7.831 3.831L7.873 3.873Q7.957 3.873 7.957 3.957L7.957 3.957L10.309 6.351Q10.519 6.519 10.309 6.729L10.309 6.729Q10.225 7.317 10.435 7.863Q10.645 8.409 11.107 8.703L11.107 8.703Q11.275 8.787 11.317 8.892Q11.359 8.997 11.359 9.207L11.359 9.207L11.359 15.003Q11.359 15.255 11.107 15.507L11.107 15.507Q10.603 15.843 10.372 16.389Q10.141 16.935 10.330 17.502Q10.519 18.069 10.981 18.447Q11.443 18.825 12.031 18.825Q12.619 18.825 13.081 18.489Q13.543 18.153 13.732 17.586Q13.921 17.019 13.753 16.473Q13.585 15.927 13.081 15.507L13.081 15.507Q12.913 15.423 12.871 15.318Q12.829 15.213 12.829 15.003L12.829 15.003L12.829 9.081L12.955 9.081L15.055 11.181Q15.139 11.265 15.139 11.391L15.139 11.391L15.181 11.475L15.181 12.231Q15.265 13.029 15.874 13.470Q16.483 13.911 17.281 13.806Q18.079 13.701 18.562 13.029Q19.045 12.357 18.835 11.601L18.835 11.601Q18.751 10.929 18.100 10.488Q17.449 10.047 16.735 10.131L16.735 10.131Q16.483 10.131 16.231 10.005L16.231 10.005L14.005 7.779Q13.879 7.653 13.879 7.401L13.879 7.401Q14.005 6.813 13.711 6.267Q13.417 5.721 12.871 5.448Q12.325 5.175 11.779 5.301L11.779 5.301Q11.359 5.301 11.359 5.175L11.359 5.175Q9.805 3.579 9.007 2.907L9.007 2.907Q8.797 2.739 9.007 2.529L9.007 2.529Q9.469 2.193 10.183 1.353L10.183 1.353L10.729 0.807Q11.905-0.369 13.081 0.807L13.081 0.807L23.035 10.803Q24.253 11.979 23.035 13.155L23.035 13.155L13.291 22.941Q12.913 23.319 12.745 23.445L12.745 23.445Q12.409 23.739 12.031 23.781L12.031 23.781L11.779 23.781L11.569 23.697Q11.065 23.487 10.855 23.277L10.855 23.277L10.057 22.479Q8.881 21.387 8.335 20.757L8.335 20.757L1.153 13.575Q1.069 13.365 0.775 13.029L0.775 13.029Q0.397 12.525 0.355 12.231Z"/></svg></a><a href="https://riot.im/app/#/room/#ispmail:matrix.org" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Matrix</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M22.5 1.5v21h-2.25V24H24V0h-3.75v1.5h2.25ZM7.46 7.95V9.1h.04a3.02 3.02 0 0 1 2.61-1.39c.54 0 1.03.1 1.48.32.44.2.78.58 1.01 1.1.26-.37.6-.7 1.03-.99.44-.28.95-.43 1.55-.43.45 0 .87.06 1.26.17.38.11.71.29.99.53.27.24.49.56.64.95.15.4.23.86.23 1.42v5.72h-2.34v-4.85c0-.29-.01-.56-.04-.8a1.73 1.73 0 0 0-.18-.67 1.1 1.1 0 0 0-.44-.45 1.6 1.6 0 0 0-.78-.16c-.33 0-.6.06-.8.19-.2.12-.37.29-.48.5a2 2 0 0 0-.23.69c-.04.26-.06.52-.06.78v4.77H10.6v-4.8l-.01-.75a2.29 2.29 0 0 0-.14-.69c-.08-.2-.23-.38-.42-.5a1.5 1.5 0 0 0-.85-.2c-.15.01-.3.04-.44.08-.19.06-.37.15-.52.28-.18.14-.32.34-.44.6-.12.26-.18.6-.18 1.02v4.96H5.25V7.94h2.21ZM1.5 1.5v21h2.25V24H0V0h3.75v1.5H1.5Z"/></svg></a><a href="https://comentario.workaround.org/api/rss/comments?domain=0f111a27-fbfa-48af-8beb-ab12e612d92f" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Feed</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M2.88 16.88a3 3 0 0 0 0 4.24 3 3 0 0 0 4.24 0 3 3 0 0 0-4.24-4.24Zm2.83 2.83a1 1 0 0 1-1.42-1.42 1 1 0 0 1 1.42 0 1 1 0 0 1 0 1.42ZM5 12a1 1 0 0 0 0 2 5 5 0 0 1 5 5 1 1 0 0 0 2 0 7 7 0 0 0-7-7Zm0-4a1 1 0 0 0 0 2 9 9 0 0 1 9 9 1 1 0 0 0 2 0 11.08 11.08 0 0 0-3.22-7.78A11.08 11.08 0 0 0 5 8Zm10.61.39A15.11 15.11 0 0 0 5 4a1 1 0 0 0 0 2 13 13 0 0 1 13 13 1 1 0 0 0 2 0 15.11 15.11 0 0 0-4.39-10.61Z"/></svg></a> </div> <starlight-theme-select> <label style="--sl-select-width: 6.25em" class="astro-4yphtoen"> <span class="sr-only astro-4yphtoen">Select theme</span> <svg aria-hidden="true" class="icon label-icon astro-4yphtoen astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21 14h-1V7a3 3 0 0 0-3-3H7a3 3 0 0 0-3 3v7H3a1 1 0 0 0-1 1v2a3 3 0 0 0 3 3h14a3 3 0 0 0 3-3v-2a1 1 0 0 0-1-1ZM6 7a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1v7H6V7Zm14 10a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1v-1h16v1Z"/></svg> <select autocomplete="off" class="astro-4yphtoen"> <option value="dark" class="astro-4yphtoen">Dark</option><option value="light" class="astro-4yphtoen">Light</option><option value="auto" selected class="astro-4yphtoen">Auto</option> </select> <svg aria-hidden="true" class="icon caret astro-4yphtoen astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M17 9.17a1 1 0 0 0-1.41 0L12 12.71 8.46 9.17a1 1 0 1 0-1.41 1.42l4.24 4.24a1.002 1.002 0 0 0 1.42 0L17 10.59a1.002 1.002 0 0 0 0-1.42Z"/></svg> </label> </starlight-theme-select> <script>
StarlightThemeProvider.updatePickers();
</script> </div> </div> </div> </div> </nav> <div class="main-frame astro-vrdttmbt"> <script type="module">const a=document.getElementById("starlight__sidebar"),n=a?.querySelector("sl-sidebar-state-persist"),o="sl-sidebar-state",i=()=>{let t=[];const e=n?.dataset.hash||"";try{const s=sessionStorage.getItem(o),r=JSON.parse(s||"{}");Array.isArray(r.open)&&r.hash===e&&(t=r.open)}catch{}return{hash:e,open:t,scroll:a?.scrollTop||0}},c=t=>{try{sessionStorage.setItem(o,JSON.stringify(t))}catch{}},d=()=>c(i()),l=(t,e)=>{const s=i();s.open[e]=t,c(s)};n?.addEventListener("click",t=>{if(!(t.target instanceof Element))return;const e=t.target.closest("summary")?.closest("details");if(!e)return;const s=e.querySelector("sl-sidebar-restore"),r=parseInt(s?.dataset.index||"");isNaN(r)||l(!e.open,r)});addEventListener("visibilitychange",()=>{document.visibilityState==="hidden"&&d()});addEventListener("pageHide",d);</script> <div class="lg:sl-flex astro-67yu43on"> <aside class="right-sidebar-container print:hidden astro-67yu43on"> <div class="right-sidebar astro-67yu43on"> <div class="lg:sl-hidden astro-pb3aqygn"><mobile-starlight-toc data-min-h="2" data-max-h="3" class="astro-doynk5tl"><nav aria-labelledby="starlight__on-this-page--mobile" class="astro-doynk5tl"><details id="starlight__mobile-toc" class="astro-doynk5tl"><summary id="starlight__on-this-page--mobile" class="sl-flex astro-doynk5tl"><span class="toggle sl-flex astro-doynk5tl">On this page<svg aria-hidden="true" class="caret astro-doynk5tl astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1rem;"><path d="m14.83 11.29-4.24-4.24a1 1 0 1 0-1.42 1.41L12.71 12l-3.54 3.54a1 1 0 0 0 0 1.41 1 1 0 0 0 .71.29 1 1 0 0 0 .71-.29l4.24-4.24a1.002 1.002 0 0 0 0-1.42Z"/></svg></span><span class="display-current astro-doynk5tl"></span></summary><div class="dropdown astro-doynk5tl"><ul class="isMobile astro-g2bywc46" style="--depth: 0;"> <li class="astro-g2bywc46" style="--depth: 0;"> <a href="#_top" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Overview</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#what-makes-mail-clients-trust-a-certificate" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">What makes mail clients trust a certificate?</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#where-is-the-certificate-used" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Where is the certificate used?</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#choosing-a-hostname-for-your-mail-server" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Choosing a hostname for your mail server</span> </a> <ul class="isMobile astro-g2bywc46" style="--depth: 1;"> <li class="astro-g2bywc46" style="--depth: 1;"> <a href="#option-1-a-generic-name-and-a-single-certificate" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Option 1: a generic name and a single certificate</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#option-2-multiple-namescertificates--sni" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Option 2: multiple names/certificates &amp; SNI</span> </a> </li> </ul> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#preparing-the-apache-web-server-for-http" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Preparing the Apache web server for HTTP</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#getting-a-letsencrypt-certificate" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Getting a LetsEncrypt certificate</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#add-https" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Add HTTPS</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#redirect-http-to-https" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Redirect HTTP to HTTPS</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#automatic-certificate-renewal" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Automatic certificate renewal</span> </a> </li> </ul> </div></details></nav></mobile-starlight-toc><script type="module" src="/_astro/MobileTableOfContents.astro_astro_type_script_index_0_lang.C181hMzK.js"></script></div><div class="right-sidebar-panel sl-hidden lg:sl-block astro-pb3aqygn"><div class="sl-container astro-pb3aqygn"><starlight-toc data-min-h="2" data-max-h="3"><nav aria-labelledby="starlight__on-this-page"><h2 id="starlight__on-this-page">On this page</h2><ul class="astro-g2bywc46" style="--depth: 0;"> <li class="astro-g2bywc46" style="--depth: 0;"> <a href="#_top" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Overview</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#what-makes-mail-clients-trust-a-certificate" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">What makes mail clients trust a certificate?</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#where-is-the-certificate-used" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Where is the certificate used?</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#choosing-a-hostname-for-your-mail-server" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Choosing a hostname for your mail server</span> </a> <ul class="astro-g2bywc46" style="--depth: 1;"> <li class="astro-g2bywc46" style="--depth: 1;"> <a href="#option-1-a-generic-name-and-a-single-certificate" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Option 1: a generic name and a single certificate</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#option-2-multiple-namescertificates--sni" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">Option 2: multiple names/certificates &amp; SNI</span> </a> </li> </ul> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#preparing-the-apache-web-server-for-http" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Preparing the Apache web server for HTTP</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#getting-a-letsencrypt-certificate" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Getting a LetsEncrypt certificate</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#add-https" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Add HTTPS</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#redirect-http-to-https" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Redirect HTTP to HTTPS</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#automatic-certificate-renewal" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Automatic certificate renewal</span> </a> </li> </ul> </nav></starlight-toc><script type="module" src="/_astro/TableOfContents.astro_astro_type_script_index_0_lang.CKWWgpjV.js"></script></div></div> </div> </aside> <div class="main-pane astro-67yu43on"> <main data-pagefind-body class="astro-bguv2lll" lang="en" dir="ltr"> <section style="background-color: #ffefef; padding: 1rem; border: 1px solid #f00; text-align: center;" class="astro-kggsjsm4">
⚠️ This page is part of the ISPmail guide for Debian Bookworm. Please use the newer guide for <a href="/ispmail-trixie/" class="astro-kggsjsm4">Debian Trixie</a>.
</section> <div class="content-panel astro-7nkwcw3z"> <div class="sl-container astro-7nkwcw3z"> <h1 id="_top" class="astro-j6tvhyss">TLS certificate</h1> </div> </div> <div class="content-panel astro-7nkwcw3z"> <div class="sl-container astro-7nkwcw3z"> <div class="sl-markdown-content"> <aside aria-label="TLS is SSL" class="starlight-aside starlight-aside--tip"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path fill-rule="evenodd" d="M1.44 8.855v-.001l3.527-3.516c.34-.344.802-.541 1.285-.548h6.649l.947-.947c3.07-3.07 6.207-3.072 7.62-2.868a1.821 1.821 0 0 1 1.557 1.557c.204 1.413.203 4.55-2.868 7.62l-.946.946v6.649a1.845 1.845 0 0 1-.549 1.286l-3.516 3.528a1.844 1.844 0 0 1-3.11-.944l-.858-4.275-4.52-4.52-2.31-.463-1.964-.394A1.847 1.847 0 0 1 .98 10.693a1.843 1.843 0 0 1 .46-1.838Zm5.379 2.017-3.873-.776L6.32 6.733h4.638l-4.14 4.14Zm8.403-5.655c2.459-2.46 4.856-2.463 5.89-2.33.134 1.035.13 3.432-2.329 5.891l-6.71 6.71-3.561-3.56 6.71-6.711Zm-1.318 15.837-.776-3.873 4.14-4.14v4.639l-3.364 3.374Z" clip-rule="evenodd"/><path d="M9.318 18.345a.972.972 0 0 0-1.86-.561c-.482 1.435-1.687 2.204-2.934 2.619a8.22 8.22 0 0 1-1.23.302c.062-.365.157-.79.303-1.229.415-1.247 1.184-2.452 2.62-2.935a.971.971 0 1 0-.62-1.842c-.12.04-.236.084-.35.13-2.02.828-3.012 2.588-3.493 4.033a10.383 10.383 0 0 0-.51 2.845l-.001.016v.063c0 .536.434.972.97.972H2.24a7.21 7.21 0 0 0 .878-.065c.527-.063 1.248-.19 2.02-.447 1.445-.48 3.205-1.472 4.033-3.494a5.828 5.828 0 0 0 .147-.407Z"/></svg>TLS is SSL </p> <div class="starlight-aside__content"> <p>If you are unfamiliar with the abbreviation “TLS“: it is the name successor to SSL but works one the same principle.
SSL 3.0 was just renamed to TLS 1.0 in 1999. Every new version of TLS deprecates unsafe encryption methods (ciphers)
of previous versions. You will still find people calling it <em>SSL</em>.</p> </div> </aside>
<p>The internet is not a friendly place where you can trust people. If you send data over the internet there is a pretty
good chance someone intercepts it. You dont want that. Our best weapon against that is transport encryption. All you
need is to create an encryption <em>key</em> and a <em>certificate</em> for Postfix (SMTP), Dovecot (IMAP/POP3) and Apache (HTTPS). If
you are confused why that requires a key and certificate then please consider reading the Wikipedia about
<a href="https://en.wikipedia.org/wiki/Public-key_cryptography">public-key cryptography</a>. The single most important detail here:
nobody but you must have access to the private key.</p>
<aside aria-label="Caution" class="starlight-aside starlight-aside--caution"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M12 16a1 1 0 1 0 0 2 1 1 0 0 0 0-2Zm10.67 1.47-8.05-14a3 3 0 0 0-5.24 0l-8 14A3 3 0 0 0 3.94 22h16.12a3 3 0 0 0 2.61-4.53Zm-1.73 2a1 1 0 0 1-.88.51H3.94a1 1 0 0 1-.88-.51 1 1 0 0 1 0-1l8-14a1 1 0 0 1 1.78 0l8.05 14a1 1 0 0 1 .05 1.02v-.02ZM12 8a1 1 0 0 0-1 1v4a1 1 0 0 0 2 0V9a1 1 0 0 0-1-1Z"/></svg>Caution </p> <div class="starlight-aside__content"> <p>Do not use different certificates for Postfix and Dovecot. At least the MacOS mail client would refuse your connection
with confusing error messages. You will be safe If you follow this guide.</p> </div> </aside>
<div class="sl-heading-wrapper level-h2"><h2 id="what-makes-mail-clients-trust-a-certificate">What makes mail clients trust a certificate?</h2><a class="sl-anchor-link" href="#what-makes-mail-clients-trust-a-certificate"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “What makes mail clients trust a certificate?”</span></a></div>
<p>Your clients operating system contains a list of “trusted” certificate authorities. Sometimes that list is located in a
central location for all applications. And sometimes a browser comes with its own list. A certificate signed by any of
those organization is fully trusted. Yes, your browser trusts companies you probably have never heard of. And so does
your mail client if you use software like Thunderbird instead of using web mail. The tricky part is not the technology.
Everyone with some knowledge about certificates can create their own authority. Mathematically your certificates are
just as good as anyone elses. The tricky part is to convince browser manufacturers to trust them and add your
certificates to their trust list.</p>
<p>Those organization claim to do checks (in exchange for money) whether you are the righteous owner of a certain domain.
These checks have sometimes failed so badly that they popped up in the news. Ten years ago a nerd
<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=647959">requested</a> to get trusted by Firefox with his “Honest Achmeds
Used Cars and Certificates” authority. It was fun to watch the developers struggle with arguments why Achmed would be
any worse than authorities like
<a href="https://arstechnica.com/information-technology/2013/01/turkish-government-agency-spoofed-google-certificate-accidentally/">Türktrust</a>
or <a href="https://en.wikipedia.org/wiki/Verisign#2001:_Code_signing_certificate_mistake">Verisign</a> (who failed so hard one
must wonder why they are still in business).</p>
<p>In 2012 <a href="https://en.wikipedia.org/wiki/Let%27s_Encrypt#History">two Mozilla employees</a> decided to do something about
that. They came up with the idea of a non-profit certificate authority. The world needed encryption everywhere and
people should no longer shy away from it because getting certificates cost money. Two years later the service was ready
and everyone could get a free certificate valid for 90 days. An automated process renewed the certificate in time so
there was no hassle. (They surely deserve a <a href="https://letsencrypt.org/donate/">donation</a> for the many years of service to
the internet community.)</p>
<div class="sl-heading-wrapper level-h2"><h2 id="where-is-the-certificate-used">Where is the certificate used?</h2><a class="sl-anchor-link" href="#where-is-the-certificate-used"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Where is the certificate used?”</span></a></div>
<p>You guessed it, we will need our own certificate. It will be used in three places:</p>
<ol>
<li>the webmail interface (driven by the Apache web server)</li>
<li>Postfix (to encrypt SMTP communication where possible)</li>
<li>Dovecot (to encrypt IMAP/POP3 communication and deny any unencrypted traffic)</li>
</ol>
<p>A single certificate (per domain) can and should be used by all three pieces of software.</p>
<div class="sl-heading-wrapper level-h2"><h2 id="choosing-a-hostname-for-your-mail-server">Choosing a hostname for your mail server</h2><a class="sl-anchor-link" href="#choosing-a-hostname-for-your-mail-server"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Choosing a hostname for your mail server”</span></a></div>
<p>Your mail server will be able to serve emails in many domains. But a certificate is usually issued for a single
<a href="https://en.wikipedia.org/wiki/Fully_qualified_domain_name">fully-qualified domain name</a> like “mail.example.org”. The
<em>common name</em> is an important part of the certificate. That attribute must correspond to the host name you use during
communication or else the certificate is rejected. Hmmm, many domains but only one name is allowed on a certificate? How
do we deal with that?</p>
<div class="sl-heading-wrapper level-h3"><h3 id="option-1-a-generic-name-and-a-single-certificate">Option 1: a generic name and a single certificate</h3><a class="sl-anchor-link" href="#option-1-a-generic-name-and-a-single-certificate"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Option 1: a generic name and a single certificate”</span></a></div>
<p>The simple solution is to take a generic name. The German ISP Hetzner for example uses the name “mail.your-server.de”
for all customers and their domains. And there are many examples of such an approach. Experience shows that most users
do not care about the hostname as long as they get their emails. So I would generally recommend this approach due to its
simplicity.</p>
<div class="sl-heading-wrapper level-h3"><h3 id="option-2-multiple-namescertificates--sni">Option 2: multiple names/certificates &#x26; SNI</h3><a class="sl-anchor-link" href="#option-2-multiple-namescertificates--sni"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Option 2: multiple names/certificates &#x26; SNI”</span></a></div>
<p>Some people however want to give their mail server as many names as they have domains. Suppose that you have three
domains: example.org, example.net and example.com. Users of example.org can use mail.example.org while users of
example.net use mail.example.net. As you can imagine this would not work if you had a single certificate. After all
which name would you use as a <em>common name</em> there? If you used “mail.example.org” then talking to your server by the
name “mail.example.net” would lead to a certificate error.</p>
<p>So your mail server needs multiple certificates one for each host name. And depending on how a user connects to your
server you need to send the matching certificate. If the user wants to speak to “mail.example.org” then your server
needs to send the certificate for “mail.example.org”. Fortunately that problem has been addressed by a technique called
<a href="https://en.wikipedia.org/wiki/Server_Name_Indication">Server Name Indication (SNI)</a>. A client talks to the server and
even before the encrypted connection is established it tells the server that it expects a certificate for the intended
host name. The server can then load the matching certificate and initiate the encryption process.</p>
<p>SNI has long been a problem for mail servers. The mail user agent (e.g. Thunderbird) needs to support it as well as
Postfix and Dovecot. Postfix has finally added SNI in version 3.4 so that we can use it.</p>
<p>While adding multiple host names needs extra work, it also has a benefit. If you want to move domains to other servers
(e.g. when upgrading your server) you can move one domain at a time.</p>
<aside aria-label="More security?" class="starlight-aside starlight-aside--tip"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path fill-rule="evenodd" d="M1.44 8.855v-.001l3.527-3.516c.34-.344.802-.541 1.285-.548h6.649l.947-.947c3.07-3.07 6.207-3.072 7.62-2.868a1.821 1.821 0 0 1 1.557 1.557c.204 1.413.203 4.55-2.868 7.62l-.946.946v6.649a1.845 1.845 0 0 1-.549 1.286l-3.516 3.528a1.844 1.844 0 0 1-3.11-.944l-.858-4.275-4.52-4.52-2.31-.463-1.964-.394A1.847 1.847 0 0 1 .98 10.693a1.843 1.843 0 0 1 .46-1.838Zm5.379 2.017-3.873-.776L6.32 6.733h4.638l-4.14 4.14Zm8.403-5.655c2.459-2.46 4.856-2.463 5.89-2.33.134 1.035.13 3.432-2.329 5.891l-6.71 6.71-3.561-3.56 6.71-6.711Zm-1.318 15.837-.776-3.873 4.14-4.14v4.639l-3.364 3.374Z" clip-rule="evenodd"/><path d="M9.318 18.345a.972.972 0 0 0-1.86-.561c-.482 1.435-1.687 2.204-2.934 2.619a8.22 8.22 0 0 1-1.23.302c.062-.365.157-.79.303-1.229.415-1.247 1.184-2.452 2.62-2.935a.971.971 0 1 0-.62-1.842c-.12.04-.236.084-.35.13-2.02.828-3.012 2.588-3.493 4.033a10.383 10.383 0 0 0-.51 2.845l-.001.016v.063c0 .536.434.972.97.972H2.24a7.21 7.21 0 0 0 .878-.065c.527-.063 1.248-.19 2.02-.447 1.445-.48 3.205-1.472 4.033-3.494a5.828 5.828 0 0 0 .147-.407Z"/></svg>More security? </p> <div class="starlight-aside__content"> <p>If you wish to further enhance security against <a href="https://en.wikipedia.org/wiki/Man-in-the-middle_attack">man-in-the-middle
attacks</a> you should get acquainted
with <a href="https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions">DNSSEC</a> and <a href="https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities">DANE</a>.
Also take a look at
the <a href="http://www.postfix.org/postconf.5.html#smtp_dns_support_level">smtp_dns_support_level</a> parameter in Postfix.</p> </div> </aside>
<div class="sl-heading-wrapper level-h2"><h2 id="preparing-the-apache-web-server-for-http">Preparing the Apache web server for HTTP</h2><a class="sl-anchor-link" href="#preparing-the-apache-web-server-for-http"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Preparing the Apache web server for HTTP”</span></a></div>
<p>Lets start with the web server. As an example I will assume that you want to offer a host name <strong>webmail.example.org</strong>
to your users. Of course your server will have another name in a domain that you control. I will use that example
throughout the tutorial though and keep that name printed in <strong>bold</strong> letters to remind you that you have to use your
own host name.</p>
<p>Do you just want to play around with your new server and not use any real domain yet? No problem. Then use
<a href="https://nip.io/">nip.io</a>. If your IP address is 1.2.3.4 then you can use 1.2.3.4.nip.io as a domain name that points to
your server. (There used to be another domain xip.io for that purpose but it died in mid-2021.) Another service like
that which also supports IPv6 is <a href="https://sslip.io/">sslip.io</a>.</p>
<p>If you have an actual domain then set up a DNS “A” and “AAAA” (if you use IPv6) record for that host name pointing to
your servers IP address.</p>
<p>First you need a web root directory for that host name:</p>
<div class="expressive-code"><link rel="stylesheet" href="/_astro/ec.v4551.css"><script type="module" src="/_astro/ec.0vx5m.js"></script><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">mkdir /var/www/webmail.example.org</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">chown www-data:www-data /var/www/webmail.example.org</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="mkdir /var/www/webmail.example.orgchown www-data:www-data /var/www/webmail.example.org"><div></div></button></div></figure></div>
<p>Next you need to create a virtual host configuration file. Apache on Debian uses a neat system to manage virtual hosts:</p>
<ul>
<li><code dir="auto">/etc/apache2/sites-available/*.conf</code> contains the actual configuration files for each virtual host. Putting a file
here does not enable that host though. Thats done in the next step. There are two configuration files by default.
“000-default.conf” is a HTTP virtual host and “default-ssl.conf” is a HTTPS virtual host.</li>
<li><code dir="auto">/etc/apache2/sites-enabled/*.conf</code> contains symbolic links (“symlinks”) pointing to configuration files in the
/etc/apache2/sites-available directory. Only *.conf links in this directory will be loaded by Apache.</li>
</ul>
<p>This technique allows you to enable and disable virtual hosts without having to destroy any configuration. Debian ships
with the “a2ensite” (short for “apache2 enable site”) and “a2dissite” commands. In addition to some sanity checks those
commands essentially create or remove symlinks between “sites-available” and “sites-enabled”.</p>
<aside aria-label="Tip" class="starlight-aside starlight-aside--tip"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path fill-rule="evenodd" d="M1.44 8.855v-.001l3.527-3.516c.34-.344.802-.541 1.285-.548h6.649l.947-.947c3.07-3.07 6.207-3.072 7.62-2.868a1.821 1.821 0 0 1 1.557 1.557c.204 1.413.203 4.55-2.868 7.62l-.946.946v6.649a1.845 1.845 0 0 1-.549 1.286l-3.516 3.528a1.844 1.844 0 0 1-3.11-.944l-.858-4.275-4.52-4.52-2.31-.463-1.964-.394A1.847 1.847 0 0 1 .98 10.693a1.843 1.843 0 0 1 .46-1.838Zm5.379 2.017-3.873-.776L6.32 6.733h4.638l-4.14 4.14Zm8.403-5.655c2.459-2.46 4.856-2.463 5.89-2.33.134 1.035.13 3.432-2.329 5.891l-6.71 6.71-3.561-3.56 6.71-6.711Zm-1.318 15.837-.776-3.873 4.14-4.14v4.639l-3.364 3.374Z" clip-rule="evenodd"/><path d="M9.318 18.345a.972.972 0 0 0-1.86-.561c-.482 1.435-1.687 2.204-2.934 2.619a8.22 8.22 0 0 1-1.23.302c.062-.365.157-.79.303-1.229.415-1.247 1.184-2.452 2.62-2.935a.971.971 0 1 0-.62-1.842c-.12.04-.236.084-.35.13-2.02.828-3.012 2.588-3.493 4.033a10.383 10.383 0 0 0-.51 2.845l-.001.016v.063c0 .536.434.972.97.972H2.24a7.21 7.21 0 0 0 .878-.065c.527-.063 1.248-.19 2.02-.447 1.445-.48 3.205-1.472 4.033-3.494a5.828 5.828 0 0 0 .147-.407Z"/></svg>Tip </p> <div class="starlight-aside__content"> Apache configuration files must have a “.conf” suffix or else they will get ignored </div> </aside>
<p>You may remove the default symlinks in <code dir="auto">/etc/apache2/sites-enabled/*</code> unless you use them already.</p>
<p>Create a new virtual host configuration file /etc/apache2/sites-available/<strong>webmail.example.org</strong>-http.conf and make it
contain:</p>
<pre><p>&#x3C;VirtualHost *:80> ServerName <strong>webmail.example.org</strong> DocumentRoot /var/www/<strong>webmail.example.org</strong>
&#x3C;/VirtualHost></p></pre>
<p>The simple configuration makes Apache handle HTTP requests (on the standard TCP port 80) if a certain line in the
request header from the browser reads “Host: webmail.example.org”. So the browser actually tells your Apache web server
which server name it is looking for. That allows for multiple web sites on a single IP address. (Thanks to
<a href="https://en.wikipedia.org/wiki/Server_Name_Indication">Server Name Indication</a> as explained earlier this works well for
HTTPS, too.)</p>
<p>Enable the site:</p>
<pre>a2ensite <strong>webmail.example.org</strong>-http</pre>
<p>You will be told:</p>
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">To activate the new configuration, you need to run:</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">systemctl reload apache2</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="To activate the new configuration, you need to run: systemctl reload apache2"><div></div></button></div></figure></div>
<p>Do that.</p>
<aside aria-label="Apache shows an error?" class="starlight-aside starlight-aside--tip"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path fill-rule="evenodd" d="M1.44 8.855v-.001l3.527-3.516c.34-.344.802-.541 1.285-.548h6.649l.947-.947c3.07-3.07 6.207-3.072 7.62-2.868a1.821 1.821 0 0 1 1.557 1.557c.204 1.413.203 4.55-2.868 7.62l-.946.946v6.649a1.845 1.845 0 0 1-.549 1.286l-3.516 3.528a1.844 1.844 0 0 1-3.11-.944l-.858-4.275-4.52-4.52-2.31-.463-1.964-.394A1.847 1.847 0 0 1 .98 10.693a1.843 1.843 0 0 1 .46-1.838Zm5.379 2.017-3.873-.776L6.32 6.733h4.638l-4.14 4.14Zm8.403-5.655c2.459-2.46 4.856-2.463 5.89-2.33.134 1.035.13 3.432-2.329 5.891l-6.71 6.71-3.561-3.56 6.71-6.711Zm-1.318 15.837-.776-3.873 4.14-4.14v4.639l-3.364 3.374Z" clip-rule="evenodd"/><path d="M9.318 18.345a.972.972 0 0 0-1.86-.561c-.482 1.435-1.687 2.204-2.934 2.619a8.22 8.22 0 0 1-1.23.302c.062-.365.157-.79.303-1.229.415-1.247 1.184-2.452 2.62-2.935a.971.971 0 1 0-.62-1.842c-.12.04-.236.084-.35.13-2.02.828-3.012 2.588-3.493 4.033a10.383 10.383 0 0 0-.51 2.845l-.001.016v.063c0 .536.434.972.97.972H2.24a7.21 7.21 0 0 0 .878-.065c.527-.063 1.248-.19 2.02-.447 1.445-.48 3.205-1.472 4.033-3.494a5.828 5.828 0 0 0 .147-.407Z"/></svg>Apache shows an error? </p> <div class="starlight-aside__content"> <p>If after reloading/restarting the Apache web server you just get an error message like…</p><div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">Job for apache2.service failed.</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">See “systemctl status apache2.service” and “journalctl -xeu apache2.service” for details.</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="Job for apache2.service failed.See “systemctl status apache2.service” and “journalctl -xeu apache2.service” for details."><div></div></button></div></figure></div><p>…then run “apache2ctl configtest” to find out why it is unhappy about your configuration.”</p> </div> </aside>
<p>Lets check if the configuration works. Put a test file into your web root directory:</p>
<pre>echo “Just a test” > /var/www/<strong>webmail.example.org</strong>/test</pre>
<p>Now when you open the URL http://<strong>webmail.example.org</strong>/test in your browser you should see the text “Just a test”.</p>
<p>This is enough setup to make LetsEncrypt issue a certificate for you.</p>
<div class="sl-heading-wrapper level-h2"><h2 id="getting-a-letsencrypt-certificate">Getting a LetsEncrypt certificate</h2><a class="sl-anchor-link" href="#getting-a-letsencrypt-certificate"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Getting a LetsEncrypt certificate”</span></a></div>
<p>Now you can use the <em>certbot</em> tool to request an encryption certificate from LetsEncrypt. What will happen?</p>
<ul>
<li>certbot creates a <em>private key</em> and a <em>certificate request</em>. It sends the <em>certificate request</em> to the LetsEncrypt
server.</li>
<li>the LetsEncrypt server replies with a <em>challenge</em>/<em>token</em>.</li>
<li>certbot puts that token into a file in the /var/www/<strong>webmail.example.org</strong>/.well-known/acme-challenge directory.</li>
<li>the LetsEncrypt server does an HTTP connection to <code dir="auto">http://webmail.example.org/.well-known/acme-challenge/…</code> and
expects to find that token. This verifies that you are in charge of the domain and the web server.</li>
<li>If all works well the LetsEncrypt server signs your <em>certificate request</em> and thus creates the actual <em>certificate</em>.</li>
<li>certbot receives the certificate and puts it into /etc/letsencrypt/archive/<strong>webmail.example.org</strong>/</li>
</ul>
<p>To get a certificate for your domain run:</p>
<pre class="wrap"><p>certbot certonly --webroot --webroot-path /var/www/<strong>webmail.example.org</strong> -d <strong>webmail.example.org</strong></p></pre>
<p>You can use multiple occurences of “-d” here to get a certificate valid for multiple domains. For example: “-d
webmail.example.org -d something-else.example.org”. (See also:
<a href="https://eff-certbot.readthedocs.io/en/stable/using.html#webroot">https://eff-certbot.readthedocs.io/en/stable/using.html#webroot</a>)</p>
<p>The first time you do that you will get asked for your email address so LetsEncrypt can send you reminders if your
certificate would expire. You will also have to agree to their terms of service.</p>
<p>If everything worked well you should get output like:</p>
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">Requesting a certificate for webmail.example.org Successfully received certificate. Certificate is saved at:</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">/etc/letsencrypt/live/webmail.example.org/fullchain.pem Key is saved at:</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">/etc/letsencrypt/live/webmail.example.org/privkey.pem This certificate expires on 2024-01-02. These files will be</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">the background.</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code=" Requesting a certificate for webmail.example.org Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/webmail.example.org/fullchain.pem Key is saved at: /etc/letsencrypt/live/webmail.example.org/privkey.pem This certificate expires on 2024-01-02. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in the background."><div></div></button></div></figure></div>
<p>In /etc/letsencrypt/live/<strong>webmail.example.org</strong> you will find a couple of files now:</p>
<ul>
<li>cert.pem: the certificate file</li>
<li>chain.pem: the <em>chaining</em> or <em>intermediate</em> certificate. This certificate provides information how the LetsEncrypt
certificates are linked to other known certificate authorities. It is generally a good idea to always send this
certificate along with your own for clients who may not know LetsEncrypt properly yet.</li>
<li>fullchain.pem: this file contains a concatenation of the <em>cert.pem</em> and the <em>chain.pem</em>. This is the preferred file to
use when a piece of software asks where to find the <em>certificate</em>.</li>
<li>privkey.pem: the private key file. Keep it secret.</li>
</ul>
<aside aria-label="Expires in 3 months?" class="starlight-aside starlight-aside--tip"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path fill-rule="evenodd" d="M1.44 8.855v-.001l3.527-3.516c.34-.344.802-.541 1.285-.548h6.649l.947-.947c3.07-3.07 6.207-3.072 7.62-2.868a1.821 1.821 0 0 1 1.557 1.557c.204 1.413.203 4.55-2.868 7.62l-.946.946v6.649a1.845 1.845 0 0 1-.549 1.286l-3.516 3.528a1.844 1.844 0 0 1-3.11-.944l-.858-4.275-4.52-4.52-2.31-.463-1.964-.394A1.847 1.847 0 0 1 .98 10.693a1.843 1.843 0 0 1 .46-1.838Zm5.379 2.017-3.873-.776L6.32 6.733h4.638l-4.14 4.14Zm8.403-5.655c2.459-2.46 4.856-2.463 5.89-2.33.134 1.035.13 3.432-2.329 5.891l-6.71 6.71-3.561-3.56 6.71-6.711Zm-1.318 15.837-.776-3.873 4.14-4.14v4.639l-3.364 3.374Z" clip-rule="evenodd"/><path d="M9.318 18.345a.972.972 0 0 0-1.86-.561c-.482 1.435-1.687 2.204-2.934 2.619a8.22 8.22 0 0 1-1.23.302c.062-.365.157-.79.303-1.229.415-1.247 1.184-2.452 2.62-2.935a.971.971 0 1 0-.62-1.842c-.12.04-.236.084-.35.13-2.02.828-3.012 2.588-3.493 4.033a10.383 10.383 0 0 0-.51 2.845l-.001.016v.063c0 .536.434.972.97.972H2.24a7.21 7.21 0 0 0 .878-.065c.527-.063 1.248-.19 2.02-.447 1.445-.48 3.205-1.472 4.033-3.494a5.828 5.828 0 0 0 .147-.407Z"/></svg>Expires in 3 months? </p> <div class="starlight-aside__content"> <p>LetsEncrypt issues certificates that are valid for 3 months. This is by design to get rid of old certificates quickly.
The renewal feature of the certbot will automatically get a fresh certificate after 2 months. So you dont have to
worry about that. And if a renewal failed you will get an email from them reminding you to take a look.</p> </div> </aside>
<div class="sl-heading-wrapper level-h2"><h2 id="add-https">Add HTTPS</h2><a class="sl-anchor-link" href="#add-https"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Add HTTPS”</span></a></div>
<p>Now that you have a valid certificate you can finally enable HTTPS for your web server. Create a new file
/etc/apache2/sites-available/<strong>webmail.example.org</strong>-https.conf containing:</p>
<pre><p>&#x3C;VirtualHost *:443> ServerName <strong>webmail.example.org</strong> DocumentRoot /var/www/<strong>webmail.example.org</strong> SSLEngine
on SSLCertificateFile /etc/letsencrypt/live/<strong>webmail.example.org</strong>/fullchain.pem SSLCertificateKeyFile
/etc/letsencrypt/live/<strong>webmail.example.org</strong>/privkey.pem &#x3C;/VirtualHost></p></pre>
<p>This virtual host configuration looks suspiciously similar to the HTTP virtual host above. It just listens on port 443
(standard port for HTTPS) instead of port 80. And it uses the “SSLEngine” that handles encryption and gets information
about the certificate for your web server (that is shown to your users) and the private key (that the web servers uses
to decrypt the users communication).</p>
<p>Enable the SSL module in Apache:</p>
<pre>a2enmod ssl</pre>
<p>Then enable the virtual host for HTTPS:</p>
<pre>a2ensite <strong>webmail.example.org</strong>-https</pre>
<p>And <em>restart</em> the web server. A <em>reload</em> is not sufficient this time because you added a module.</p>
<p>systemctl restart apache2</p>
<p>Now when you point your web browser to <strong>webmail.example.org</strong>, your browser should tell you that it trusts the web
sites certificate:</p>
<p><img src="/_astro/tls-browser-bar.Czwy_9Iz_Z1DnMs5.webp" alt="Browser bar showing successful encryption" loading="lazy" decoding="async" fetchpriority="auto" width="480" height="226"></p>
<p>(Yes, sorry, this is not <strong>webmail.example.org</strong>. But I do not own the example.org domain and thus cannot get a valid
certificate for it. This is my own site.)</p>
<p>So should you keep the HTTP virtual host? Yes. First for the HTTP->HTTPS redirection. And second to keep <em>certbot</em>
working.</p>
<div class="sl-heading-wrapper level-h2"><h2 id="redirect-http-to-https">Redirect HTTP to HTTPS</h2><a class="sl-anchor-link" href="#redirect-http-to-https"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Redirect HTTP to HTTPS”</span></a></div>
<p>Sometimes users forget to enter https://… when accessing your webmail service. So they access the HTTP web site. We
obviously dont want them to send their password over HTTP. So we should redirect all HTTP connections to HTTPS.</p>
<p>One exception though. Lets Encrypt will use HTTP to verify your challenge token. So we need to serve files at
http://<strong>webmail.example.org</strong>/.well-known/acme-challenge/… directly while redirecting all other requests to HTTPS. You
can accomplish that by putting these lines inside the &#x3C;VirtualHost> section of your
<code dir="auto">/etc/apache2/sites-available/webmail.example.org-http.conf</code> file:</p>
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">RewriteEngine On</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">RewriteCond %{REQUEST_URI} !.well-known/acme-challenge</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">RewriteRule ^(.*)$ https://%{SERVER_NAME}$1 \[R=301,L\]</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="RewriteEngine OnRewriteCond %{REQUEST_URI} !.well-known/acme-challengeRewriteRule ^(.*)$ https://%{SERVER_NAME}$1 \[R=301,L\]"><div></div></button></div></figure></div>
<p>This requires the <em>rewrite</em> module to be enabled in Apache. That is simple though:</p>
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">a2enmod rewrite</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">systemctl restart apache2</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="a2enmod rewritesystemctl restart apache2"><div></div></button></div></figure></div>
<p>So now entering http://<strong>webmail.example.org</strong> will redirect you to https://<strong>webmail.example.org</strong>.</p>
<div class="sl-heading-wrapper level-h2"><h2 id="automatic-certificate-renewal">Automatic certificate renewal</h2><a class="sl-anchor-link" href="#automatic-certificate-renewal"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Automatic certificate renewal”</span></a></div>
<p>The <em>certbot</em> package automatically adds a timed job that runs twice a day at random times. The random part is important
to avoid millions of server hammering the LetsEncrypt service at the same second.</p>
<aside aria-label="Systemd timer instead of a Cron job" class="starlight-aside starlight-aside--tip"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path fill-rule="evenodd" d="M1.44 8.855v-.001l3.527-3.516c.34-.344.802-.541 1.285-.548h6.649l.947-.947c3.07-3.07 6.207-3.072 7.62-2.868a1.821 1.821 0 0 1 1.557 1.557c.204 1.413.203 4.55-2.868 7.62l-.946.946v6.649a1.845 1.845 0 0 1-.549 1.286l-3.516 3.528a1.844 1.844 0 0 1-3.11-.944l-.858-4.275-4.52-4.52-2.31-.463-1.964-.394A1.847 1.847 0 0 1 .98 10.693a1.843 1.843 0 0 1 .46-1.838Zm5.379 2.017-3.873-.776L6.32 6.733h4.638l-4.14 4.14Zm8.403-5.655c2.459-2.46 4.856-2.463 5.89-2.33.134 1.035.13 3.432-2.329 5.891l-6.71 6.71-3.561-3.56 6.71-6.711Zm-1.318 15.837-.776-3.873 4.14-4.14v4.639l-3.364 3.374Z" clip-rule="evenodd"/><path d="M9.318 18.345a.972.972 0 0 0-1.86-.561c-.482 1.435-1.687 2.204-2.934 2.619a8.22 8.22 0 0 1-1.23.302c.062-.365.157-.79.303-1.229.415-1.247 1.184-2.452 2.62-2.935a.971.971 0 1 0-.62-1.842c-.12.04-.236.084-.35.13-2.02.828-3.012 2.588-3.493 4.033a10.383 10.383 0 0 0-.51 2.845l-.001.016v.063c0 .536.434.972.97.972H2.24a7.21 7.21 0 0 0 .878-.065c.527-.063 1.248-.19 2.02-.447 1.445-.48 3.205-1.472 4.033-3.494a5.828 5.828 0 0 0 .147-.407Z"/></svg>Systemd timer instead of a Cron job </p> <div class="starlight-aside__content"> <p>This job is not a classic Cron job but instead latches into systemd. You can find the <em>timer</em> definition in
the <code dir="auto">/lib/systemd/system/certbot.timer</code> file. That timer triggers the renewal service defined
in <code dir="auto">/lib/systemd/system/certbot.service</code>. To find out if the service has run and when the next occurence will be, run
“systemctl status certbot.timer”. There is also a Cron file at /etc/cron.d/certbot. Dont be confused. This job will
not do anything due to the “<code dir="auto">-d /run/systemd/system</code>” condition that checks if systemd is installed. And Debian
nowadays uses systemd.</p> </div> </aside>
<p>So the renewal already happens automatically. Should it fail then LetsEncrypt start sending you reminder emails that
your certificate should be renewed. Thats a clear sign that something went wrong with the automatic renewal.</p>
<p>There is one puzzle piece missing though. Even if the renewal worked it will only update the certificate files. But the
software components Postfix, Dovecot and Apache will not notice the change. So we need to add a so called
<em>post-hook</em> to certbot that triggers a restart of all processes thereafter.</p>
<p>For that purpose edit the /etc/letsencrypt/cli.ini file and add:</p>
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">post-hook = systemctl restart postfix dovecot apache2</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="post-hook = systemctl restart postfix dovecot apache2"><div></div></button></div></figure></div>
<p>Well done. You have implemented Lets Encrypt for all your services now. Lets go on.</p> </div> <footer> <footer class="sl-flex astro-3yyafb3n"> <div class="meta sl-flex astro-3yyafb3n"> <p>Last updated: <time datetime="2023-10-03T00:00:00.000Z">Oct 3, 2023</time></p> </div> <div class="pagination-links print:hidden astro-u2l5gyhi" dir="ltr"> <a href="/ispmail-bookworm/install-the-software-packages/" rel="prev" class="astro-u2l5gyhi"> <svg aria-hidden="true" class="astro-u2l5gyhi astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.5rem;"><path d="M17 11H9.41l3.3-3.29a1.004 1.004 0 1 0-1.42-1.42l-5 5a1 1 0 0 0-.21.33 1 1 0 0 0 0 .76 1 1 0 0 0 .21.33l5 5a1.002 1.002 0 0 0 1.639-.325 1 1 0 0 0-.219-1.095L9.41 13H17a1 1 0 0 0 0-2Z"/></svg> <span class="astro-u2l5gyhi"> Previous <br class="astro-u2l5gyhi"> <span class="link-title astro-u2l5gyhi">Install software packages</span> </span> </a> <a href="/ispmail-bookworm/prepare-the-database/" rel="next" class="astro-u2l5gyhi"> <svg aria-hidden="true" class="astro-u2l5gyhi astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.5rem;"><path d="M17.92 11.62a1.001 1.001 0 0 0-.21-.33l-5-5a1.003 1.003 0 1 0-1.42 1.42l3.3 3.29H7a1 1 0 0 0 0 2h7.59l-3.3 3.29a1.002 1.002 0 0 0 .325 1.639 1 1 0 0 0 1.095-.219l5-5a1 1 0 0 0 .21-.33 1 1 0 0 0 0-.76Z"/></svg> <span class="astro-u2l5gyhi"> Next <br class="astro-u2l5gyhi"> <span class="link-title astro-u2l5gyhi">Preparing the database</span> </span> </a> </div> </footer> <script defer src="https://comentario.workaround.org/comentario.js"></script>
<comentario-comments no-fonts="true" id="comments"></comentario-comments> <div class="myfooter">
This guide is maintained by <a href="mailto:ispmail@christoph-haas.de">Christoph Haas</a> since 2003. All content on workaround.org can be used under the terms of
the
<a href="https://creativecommons.org/licenses/by-nc-sa/4.0/" target="_blank">Creative Commons BY-NC-SA license</a>.
Penguin image based on AI art because I suck at drawing.
</div> </footer> </div> </div> </main> </div> </div> </div> </div> </body></html>