This pages shows how to use letsencrypt with SurgeMail to create
SSL certificates.
/etc/initld/apache2 stop
(the above just stops it, lookup your system on google to see how to uninstall properly)
https://certbot.eff.org/ will tell you how to install it, just give it your version of linux...
For ubunto it told me to do this:
wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto
Modifying /etc/surgemail.ini and adjust g_webmail_port "80" and g_webmail_secure_port "443" and restart surgemail.
tellmail exit
/usr/local/surgemail/surgemail_start.sh
I'm using the -auto variant as certbot isn't installed, the command line switches are identical... replace YOUR.DOMAIN.NAME with the 'a' record for your server not the domain name (so mail.your.domain.name not your.domain.name)
./certbot-auto certonly --webroot -w /usr/local/surgemail/www -d MAIL.YOUR.DOMAIN.NAME
Initially this failed for me as the dns name I had just created took a while to propagate to the letsencrypt systems, if it fails for you it should tell you something useful about why, so read the error you get carefully.
cp /etc/letsencrypt/live/mail3.netwinsite.com/fullchain.pem /usr/local/surgemail/ssl/surge_cert.pem
cp /etc/letsencrypt/live/mail3.netwinsite.com/privkey.pem /usr/local/surgemail/ssl/surge_priv.pem
tellmail exit
/usr/local/surgemail/surgemail_start.sh
https://mail.your.domain.name
You may need a cron job to run certbot and copy the certificates. Refer to LetsEncrypt documentation for up to date information on the best practice for this, my belief is a monthly cron job something like this would be reasonable.
Crontab entry: 0 0 1 * * /root/monthly.sh
Where /root/monthly.sh contains:
#!/bin/bash
./certbot-auto certonly --webroot -w /usr/local/surgemail/www -d MAIL.YOUR.DOMAIN.NAME
cp /etc/letsencrypt/live/mail3.netwinsite.com/fullchain.pem /usr/local/surgemail/ssl/surge_cert.pem
cp /etc/letsencrypt/live/mail3.netwinsite.com/privkey.pem /usr/local/surgemail/ssl/surge_priv.pem
tellmail ssl_reload