Received-SPF: pass (Last token {include:spf.zixsmbhosted.com} (res=PASS)) client-ip=74.203.184.47; envelope-from=<fbulk@mypremieronline.com>; x-ip-name=spfaus-b.zixsmbhosted.com;
X-Received: from zh-gw.zixsmbhosted.com (spfaus-b.zixsmbhosted.com [74.203.184.47])
by netwin.co.nz (SurgeMail 7.3p) with ESMTP (TLS) id 11371632-1391920
for <surgemail-list@netwin.co.nz>; Fri, 17 May 2019 15:55:57 +0000
X-Return-Path: fbulk
X-Received: from 127.0.0.1 (ZixVPM [127.0.0.1])
by Outbound.zh-gw.zixsmbhosted.com (Proprietary) with SMTP id A9B72E3581
for <surgemail-list@netwin.co.nz>; Fri, 17 May 2019 10:55:55 -0500 (CDT)
X-Received: from encrouter02.b.smb.prod.austin.zixnet.com (encrouter02.b.smb.prod.austin.zixnet.com [10.155.130.32])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by zh-gw.zixsmbhosted.com (Proprietary) with ESMTPS id 74015E357A
for <surgemail-list@netwin.co.nz>; Fri, 17 May 2019 10:55:55 -0500 (CDT)
X-Received: from pcscmail002.MUTUALTEL.MTCNET.NET (mail.mypremieronline.com [199.120.69.84])
by encrouter02.b.smb.prod.austin.zixnet.com (Postfix) with ESMTPS id F26E1908
for <surgemail-list@netwin.co.nz>; Fri, 17 May 2019 10:55:53 -0500 (CDT)
X-Received: from pcscmail002.MUTUALTEL.MTCNET.NET
(2607:fe28:11:4000:7036:235:e3a9:cf01) by pcscmail002.mutualtel.mtcnet.net
(2607:fe28:11:4000:7036:235:e3a9:cf01) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
15.1.1713.5; Fri, 17 May 2019 10:55:47 -0500
X-Received: from pcscmail002.MUTUALTEL.MTCNET.NET ([fe80::7036:235:e3a9:cf01])
by pcscmail002.MUTUALTEL.MTCNET.NET ([fe80::7036:235:e3a9:cf01%12]) with mapi
id 15.01.1713.004; Fri, 17 May 2019 10:55:47 -0500
From: Frank Bulk
To: "surgemail-list@netwin.co.nz" <surgemail-list@netwin.co.nz>
Subject: RE: [SurgeMail List] g_ssl_auto feature - how?
Thread-Topic: [SurgeMail List] g_ssl_auto feature - how?
Thread-Index: AQHUt0l0eyyR+xHTS1mca2wOuvuNbqXJ+k4AgABu8oCApbhHUA==
Date: Fri, 17 May 2019 15:55:23 +0000
Deferred-Delivery: Fri, 17 May 2019 15:55:00 +0000
Message-ID: <87976fb3deab45e28f688abd8581a50e@mypremieronline.com>
References: <5c4f6851.247d.d886700.3188807f@netwin.co.nz>
<0d4bd51f50ce4914a0a036968818d3b5@mypremieronline.com>
<8887e41f-57e3-47f6-4b30-22530f72e19d@netwinsite.com>
In-Reply-To: <8887e41f-57e3-47f6-4b30-22530f72e19d@netwinsite.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
X-x-originating-ip: [2607:fe28:11:4000:44c1:4703:64b2:b51d]
MIME-Version: 1.0
X-ZIXHOSTED-CUSTOMER: pre51250
X-VPM-MSG-ID: e9bd2f29-559f-4692-ac79-84cac46c44e5
X-VPM-HOST: zgw-pre51250.b.smb.prod.austin.zixnet.com
X-VPM-GROUP-ID: 555c776f-95d0-4497-9848-d8a2ff3b0656
X-VPM-ENC-REGIME: Plaintext
X-VPM-IS-HYBRID: 0
X-Originating-IP: 74.203.184.47
X-Country: code=US country="United States" ip=74.203.184.47
X-ORBS-Stamp: hostkarma_yellow, hostkarma_quitok
X-Rcpt-To: <surgemail-list@netwin.co.nz>
X-Kann: +OK 0.807 0.942 4/10
X-SpamDetect: *****: 5.0 sd=5.0 NoRule 0.09(few_words) 0.90(X-Phrase:isspam) 0.10(X-myrbl:Color=yellow) 0.76(X-Verify-Helo:-ERR) 0.31(yellow_noinfo) 0.65(X-Verify-Helo:wrongip) 0.35(StandardTLD) 0.41(spfpass) 0.41(X-NotAscii:utf) 0.42(X-ORBS-Stamp:yellow) 0.43(X-Verify-MX present) 0.47(X-LangGuess:English) Saned 5.0 sanitym 4.6 -> 5.0 NotSaned s=4.6 was=5.0 Sval 4.6
X-NotAscii: charset=utf-8
X-LangGuess: English
X-Probe: +OK nothing bad found
X-Phrase: IsSpam score=1.00
X-Verify-Helo: -ERR wrongip: zh-gw.zixsmbhosted.com -> 199.30.*.* not in 74.203.184.47
X-Verify-MX: <fbulk@mypremieronline.com> senders ip (ch=74.203.184.47 msg=74.203.184.47, net=74.203.) not in mx data dom=mypremieronline.com ipname=spfaus-b.zixsmbhosted.com (199.120.69.25 208.80.206.68 199.120.69.2)
X-Encryption: SSL encrypted
X-MyRbl: Color=Yellow Age=506 Spam=2 Notspam=5 Stars=14 Good=1761 Friend=2484 Surbl=19 Catch=0 r=0.015 ip=74.203.184.47
X-IP-stats: No info recorded yet ip=74.203.184.47
List-Unsubscribe: <mailto:surgemail-list-leave@netwin.co.nz?subject=unsubscribe>
X-Mailing-List: surgemail-list@netwin.co.nz
List-ID: <surgemail-list@netwin.co.nz>
Precedence: bulk
Reply-To: surgemail-list@netwin.co.nz
Content-Transfer-Encoding: base64
Content-Transfer-Encoding: base64
Chris,
I’ve just learned that an SSL certificate is only created with the domain listed in “url_host”.
-
We currently have an SSL certificate that includes webmail and SAN (subject alternative names) pop3, smtp, and imap. Is there support in SM for that? We really can’t stop doing that without creating a huge support nightmare.
https://letsencrypt.org/docs/faq/
-
What if we want a wildcarded LE certificate? https://community.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578
Kind regards,
Frank
From: Surgemail Support <surgemail-support@netwinsite.com>
Sent: Thursday, January 31, 2019 5:07 PM
To: surgemail-list@netwin.co.nz
Subject: Re: [SurgeMail List] g_ssl_auto feature - how?
On 1/02/2019 11:35 AM, Frank Bulk wrote:
Chris,
Thanks, I had missed your previous response(s).
Two follow up questions:
- What happens if you forget to exclude those certain domains – are the certificates in the SSL directory ignored and those auto-generated in lets used?
Yes if you forget the setting it will probably over-write the ones you've coppied in with new letsencrypt ones.
- And how do you “recover” if then want to have custom SSL certificates – do you just add them to g_ssl_lets_exclude, copy the files for that domain from the ssl directory to the lets
directory, and execute “tellmail reload”? Or do you have to restart Surgemail?
Yes fix the exclude setting, copy them again from ssl to lets folder, and
tellmail ssl_update
should be sufficient.
ChrisP.
-
Frank
Yes you can but it's a bit tricky.
Step 1) You need a recent build 7.3p at least
Step 2) You copy the ssl directory tree to the lets directory tree (or the relevant domains folders at least)
Step 3) you set G_SSL_LETS_EXCLUDE "mail.xyz.com,mail.fred.com"
On Tuesday 29/01/2019 at 3:42 am, Frank Bulk wrote:
Any feedback on this? Can we turn this on only for those domains we don’t already have a separate certificate in place?
Frank
Thanks, I had been meaning to ask if we could turn this on only for domains that we don't already have a cert in place.
Frank
Sent from my Android phone using TouchDown (www.symantec.com)
-----Original Message-----
From: Jeff Crowe [jeff@wtccommunications.ca]
Received: Wednesday, 31 Oct 2018, 11:35AM
To: surgemail-list@netwinsite.com [surgemail-list@netwinsite.com]
Subject: [SurgeMail List] g_ssl_auto feature - how?
Hi there,
I have been looking for a fix for my broken Chrome SSL certs today and ran across this gem on the surgemail site:
SurgeMail Version 7.3j2 or later
With this version of surgemail ssl certificates are created and signed completely automatically for all domains, with one setting, no certbot
or other external programs are required!
What signing authority is being used?
Is it lets encrypt built into surgemail?
Will it enable add certs for all services like pop3, imap, smtp as well as https?
Will it automatically new certs close to expiration?
and lastly, where do I download this version? the current version on the download site is 7.3i2.
Inquiring minds want to know!