Using LetsEncrypt with SurgeMail


This pages shows how to use letsencrypt with SurgeMail to create SSL certificates.


Stop Apache if its running, and uninstall it (unless you want to use it)

    /etc/initld/apache2 stop
(the above just stops it, lookup your system on google to see how to uninstall properly)

Install Surgemail

    Download from http://netwinsite.com/surgemail/download.htm

Install letsencrypt certbot if it isn't on your system:

    https://certbot.eff.org/ will tell you how to install it, just give it your version of linux...

	For ubunto it told me to do this:
    wget https://dl.eff.org/certbot-auto
    chmod a+x certbot-auto

Configure SurgeMail to use port 80 and 443, and check remote access.

    Modifying /etc/surgemail.ini and adjust g_webmail_port "80"  and g_webmail_secure_port "443" and restart surgemail.

    tellmail exit
    /usr/local/surgemail/surgemail_start.sh

Use certbot to create your certificates:   

    I'm using the -auto variant as certbot isn't installed, the command line switches are identical... replace YOUR.DOMAIN.NAME with the 'a' record for your server not the domain name (so mail.your.domain.name not your.domain.name)

    ./certbot-auto certonly --webroot -w /usr/local/surgemail/www -d MAIL.YOUR.DOMAIN.NAME

    Initially this failed for me as the dns name I had just created took a while to propagate to the letsencrypt systems, if it fails for you it should tell you something useful about why, so read the error you get carefully.

Copy the certificates to surgemail and restart it.

    cp /etc/letsencrypt/live/mail3.netwinsite.com/fullchain.pem /usr/local/surgemail/ssl/surge_cert.pem
    cp /etc/letsencrypt/live/mail3.netwinsite.com/privkey.pem /usr/local/surgemail/ssl/surge_priv.pem
    tellmail exit
    /usr/local/surgemail/surgemail_start.sh

Test the new certificate. 

https://mail.your.domain.name

Setup cron job to renew certificate.

You may need a cron job to run certbot and copy the certificates. Refer to LetsEncrypt documentation for up to date information on the best practice for this, my belief is a monthly cron job something like this would be reasonable.

	Crontab entry:   0 0 1 * * /root/monthly.sh

Where /root/monthly.sh contains:

    #!/bin/bash 
./certbot-auto certonly --webroot -w /usr/local/surgemail/www -d MAIL.YOUR.DOMAIN.NAME
  cp /etc/letsencrypt/live/mail3.netwinsite.com/fullchain.pem /usr/local/surgemail/ssl/surge_cert.pem
    cp /etc/letsencrypt/live/mail3.netwinsite.com/privkey.pem /usr/local/surgemail/ssl/surge_priv.pem
    tellmail ssl_reload