1 Topic by mbitcon

  • mbitcon
  • Member
  • Offline
  • Registered: 2014-12-19
  • Posts: 4

Topic: Will there be integration with https://letsencrypt.org ?

Hello

Are there plans to integrate with https://letsencrypt.org ?
This would provide for an easy way to make encryption with official certificates easily deployable if iredmail would support automation with lets encrypt.

Mike

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Will there be integration with https://letsencrypt.org ?

I'm keeping my eyes on letsencrypt, definitely interested in this integration. Will try to integrate in future release, but no promise when it will be implemented. sorry.

3 Reply by mbitcon

  • mbitcon
  • Member
  • Offline
  • Registered: 2014-12-19
  • Posts: 4

Re: Will there be integration with https://letsencrypt.org ?

No worries - lets encrypt is still not even public beta, so we don't expect wonders regarding the timeline ;-)

Just good to know you are aware of it...

4 Reply by mlocati

  • mlocati
  • Member
  • Offline
  • Registered: 2014-11-03
  • Posts: 20

Re: Will there be integration with https://letsencrypt.org ?

Now it's in public beta wink

5 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Will there be integration with https://letsencrypt.org ?

I will try to understand how it works and how to integrate it, but have to wait until it's stable (out of beta).

6 Reply by dracoform

  • dracoform
  • Member
  • Offline
  • Registered: 2015-12-17
  • Posts: 1

Re: Will there be integration with https://letsencrypt.org ?

It basically "works" already with apache being the Webserver out of the box after upgrading Python to a more recent version than supported in the LTS of Ubuntu e.g.

Drawback is - while the SSL now is working fine it breaks all sites apart from webmail - no more admin etc.

If those changes can be reverted it would be alredy a fine solution big_smile

7 Reply by dsp3

  • dsp3
  • Member
  • Offline
  • Registered: 2015-12-23
  • Posts: 104

Re: Will there be integration with https://letsencrypt.org ?

I have LetsEncrypt working on Centos 7.2 with Iredmail 0.9.3. It's fairly straightforward installation. If I get time I'll provide instructions of how this was accomplished on my system.

8 Reply by snarfies

  • snarfies
  • Member
  • Offline
  • Registered: 2012-09-16
  • Posts: 27

Re: Will there be integration with https://letsencrypt.org ?

dsp3 wrote:

I have LetsEncrypt working on Centos 7.2 with Iredmail 0.9.3. It's fairly straightforward installation. If I get time I'll provide instructions of how this was accomplished on my system.

Any progress on that?

9 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Will there be integration with https://letsencrypt.org ?

No progress yet.

Note: there're several third-party letsencrypt clients available on github/bitbucket, it's ok to use them to get ssl cert.

10 Reply by snarfies

  • snarfies
  • Member
  • Offline
  • Registered: 2012-09-16
  • Posts: 27

Re: Will there be integration with https://letsencrypt.org ?

ZhangHuangbin wrote:

No progress yet.

Note: there're several third-party letsencrypt clients available on github/bitbucket, it's ok to use them to get ssl cert.

Thanks, but I meant dsp3's instructions.

I got an SSL cert (I think) using letsencrypt-auto certonly, I just don't know what to do with it.

11 Reply by kleedrac

  • kleedrac
  • Member
  • Offline
  • Registered: 2016-02-21
  • Posts: 1

Re: Will there be integration with https://letsencrypt.org ?

dsp3 wrote:

I have LetsEncrypt working on Centos 7.2 with Iredmail 0.9.3. It's fairly straightforward installation. If I get time I'll provide instructions of how this was accomplished on my system.

Another voice to a tutorial when you have some time dsp3 wink

12 Reply by dorpha

  • dorpha
  • Member
  • Offline
  • Registered: 2015-01-23
  • Posts: 44

Re: Will there be integration with https://letsencrypt.org ?

Currently Letsencrypt needs a valid FQDN to work properly, and this domain will be recorded on Letsencrypt's database.
ISP assigned dynamic Domain Name won't work; Letsencrypt will prompt you that it's on the black list.

13 Reply by dsp3

  • dsp3
  • Member
  • Offline
  • Registered: 2015-12-23
  • Posts: 104

Re: Will there be integration with https://letsencrypt.org ?

kleedrac wrote:
dsp3 wrote:

I have LetsEncrypt working on Centos 7.2 with Iredmail 0.9.3. It's fairly straightforward installation. If I get time I'll provide instructions of how this was accomplished on my system.

Another voice to a tutorial when you have some time dsp3 wink

Ok. I made a quick and dirty guide which can be found here

14 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Will there be integration with https://letsencrypt.org ?

dsp3 wrote:

Ok. I made a quick and dirty guide which can be found here

Excellent. Maybe you can omit the updating config files part, and point to our tutorial here:
http://www.iredmail.org/docs/use.a.boug … icate.html

15 Reply by dsp3

  • dsp3
  • Member
  • Offline
  • Registered: 2015-12-23
  • Posts: 104

Re: Will there be integration with https://letsencrypt.org ?

ZhangHuangbin wrote:
dsp3 wrote:

Ok. I made a quick and dirty guide which can be found here

Excellent. Maybe you can omit the updating config files part, and point to our tutorial here:
http://www.iredmail.org/docs/use.a.boug … icate.html

I updated to refer to back to the reference docs, but left as an example of how they will look.

16 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Will there be integration with https://letsencrypt.org ?

dsp3 wrote:

I updated to refer to back to the reference docs, but left as an example of how they will look.

Thanks. smile

By the way, the cert/chain names in Postfix are wrong:

postconf -e smtpd_tls_cert_file='/etc/letsencrypt/live/mail.domain.com/cert.pem'
postconf -e smtpd_tls_CAfile='/etc/letsencrypt/live/mail.domain.com/chain.pem'

Should the "chain.pem" be "fullchain.pem" (which is mentioned in whole tutorial)?

your Dovecot settings are improper, it should be:

ssl_cert = </path/to/cert.pem
ssl_key = </path/to/privkey.pem
ssl_ca = </path/to/fullchain.pem

Same to the MySQL/MariaDB settings.

I suggest you check our tutorial as a reference. big_smile

17 Reply by dsp3 (edited by dsp3 2016-02-23 16:38:50)

  • dsp3
  • Member
  • Offline
  • Registered: 2015-12-23
  • Posts: 104

Re: Will there be integration with https://letsencrypt.org ?

ZhangHuangbin wrote:
dsp3 wrote:

I updated to refer to back to the reference docs, but left as an example of how they will look.

Thanks. smile

By the way, the cert/chain names in Postfix are wrong:

postconf -e smtpd_tls_cert_file='/etc/letsencrypt/live/mail.domain.com/cert.pem'
postconf -e smtpd_tls_CAfile='/etc/letsencrypt/live/mail.domain.com/chain.pem'

Should the "chain.pem" be "fullchain.pem" (which is mentioned in whole tutorial)?

your Dovecot settings are improper, it should be:

ssl_cert = </path/to/cert.pem
ssl_key = </path/to/privkey.pem
ssl_ca = </path/to/fullchain.pem

Same to the MySQL/MariaDB settings.

I suggest you check our tutorial as a reference. big_smile

ZhangHuangbin wrote:
dsp3 wrote:

I updated to refer to back to the reference docs, but left as an example of how they will look.

Thanks. smile

By the way, the cert/chain names in Postfix are wrong:

postconf -e smtpd_tls_cert_file='/etc/letsencrypt/live/mail.domain.com/cert.pem'
postconf -e smtpd_tls_CAfile='/etc/letsencrypt/live/mail.domain.com/chain.pem'

Should the "chain.pem" be "fullchain.pem" (which is mentioned in whole tutorial)?

your Dovecot settings are improper, it should be:

ssl_cert = </path/to/cert.pem
ssl_key = </path/to/privkey.pem
ssl_ca = </path/to/fullchain.pem

Same to the MySQL/MariaDB settings.

I suggest you check our tutorial as a reference. big_smile

Hi Zhang. I just checked. All settings I have are correct and working on my install.
No need for ssl_ca in Dovecot as fullchain.pem takes care of that. Same with MariaDB. Postfix needs all three (CA, cert, key).
All services are working correctly, but as I stated in my post, users should refer to the reference documents you provided.

18 Reply by softwaredev16

  • softwaredev16
  • Member
  • Offline
  • Registered: 2016-03-05
  • Posts: 3

Re: Will there be integration with https://letsencrypt.org ?

I have installed iRedMail on a Ubuntu Server fresh install then i installed lets encrypt to provide SSL and now my admin panel doesn't work. i am using Apache. Any help would be great.

Thanks

19 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Will there be integration with https://letsencrypt.org ?

softwaredev16 wrote:

now my admin panel doesn't work.

What do you mean "doesn't work"?

20 Reply by softwaredev16

  • softwaredev16
  • Member
  • Offline
  • Registered: 2016-03-05
  • Posts: 3

Re: Will there be integration with https://letsencrypt.org ?

ZhangHuangbin wrote:
softwaredev16 wrote:

now my admin panel doesn't work.

What do you mean "doesn't work"?

It loads a 404 not found message

21 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Will there be integration with https://letsencrypt.org ?

softwaredev16 wrote:

It loads a 404 not found message

*) What Nginx settings did you change?
*) With iRedMail-0.9.4, iredadmin config for Nginx is just a template file: /etc/nginx/templates/iredadmin.tmpl, you just include it in /etc/nginx/conf.d/[server].conf, that's it. Please double check your Nginx config file, make sure you have this template file included.

22 Reply by softwaredev16

  • softwaredev16
  • Member
  • Offline
  • Registered: 2016-03-05
  • Posts: 3

Re: Will there be integration with https://letsencrypt.org ?

ZhangHuangbin wrote:
softwaredev16 wrote:

It loads a 404 not found message

*) What Nginx settings did you change?
*) With iRedMail-0.9.4, iredadmin config for Nginx is just a template file: /etc/nginx/templates/iredadmin.tmpl, you just include it in /etc/nginx/conf.d/[server].conf, that's it. Please double check your Nginx config file, make sure you have this template file included.

Sorry i have Apache. Do I need to switch to Nginx if so, how do I ?

23 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Will there be integration with https://letsencrypt.org ?

With Apache, please check its config file to make sure it has settings like this:

Alias /iredadmin/static "/var/www/iRedAdmin-0.1.7/static/"
WSGIScriptAlias /iredadmin "/var/www/iRedAdmin-0.1.7/iredadmin.py/"

The path to iRedAdmin and version number may be different on your server. If you cannot find it, please create a new forum topic.

24 Reply by Seper (edited by Seper 2016-04-16 11:35:42)

  • Seper
  • Member
  • Offline
  • Registered: 2016-04-16
  • Posts: 1

Re: Will there be integration with https://letsencrypt.org ?

ZhangHuangbin wrote:

With Apache, please check its config file to make sure it has settings like this:

Alias /iredadmin/static "/var/www/iRedAdmin-0.1.7/static/"
WSGIScriptAlias /iredadmin "/var/www/iRedAdmin-0.1.7/iredadmin.py/"

I had the exact same issues, I'm running iRedMail version 0.9.4 on Ubuntu 14.04. I installed letsencrypt for apache since apache was already running as part of iRedMail. TLS for dovecot and postfix was working by referencing the path to LE however the iRedMail admin panel returned a 404. Roundcube webmail was the only site that would come up.

Apache logs were showing a conflict with SNI, 

 [ssl:warn] [pid 4318] AH02292: Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)

I copied the Alias settings from /etc/apache2/sites-available/default-ssl.conf 

Alias /iredadmin/static "/opt/www/iredadmin/static/"
WSGIScriptAlias /iredadmin "/opt/www/iredadmin/iredadmin.py/"
Alias /mail "/opt/www/roundcubemail/"
Alias /awstats/icon "/usr/share/awstats/icon/"
Alias /awstatsicon "/usr/share/awstats/icon/"
ScriptAlias /awstats "/usr/lib/cgi-bin/"

And copy this in /etc/apache2/sites-available/000-default-le-ssl.conf

I restarted apache 

service apache2 restart

The admin portal came back up for me.

mail.mysite.com/awstats/awstats.pl doesn't let me log in with the same username and password set during installation for the other web sites, but that's a problem for another post.