Using LetsEncrypt with SurgeMail
This pages shows how to use letsencrypt with SurgeMail to create
SSL certificates.
SurgeMail Version 7.3j2 or later
With this version of surgemail ssl certificates are created and
signed completely automatically for all domains, with one setting:
- set g_ssl_auto "true"
- Issue the command: tellmail ssl_update (this need only be done
once, the process of updates is then automatic)
Requirements:
- Be sure your server is accessable on port 80.
- Set g_webmail_port "80"
- Set g_ssl_per_domain "true"
- Remove old g_letsencrypt setting.
- If you wish to just test the process with the test letsencrypt
service, then use: tellmail ssl_update_test
- If you generate test certificates, then delete them from the
lets/domain.name/*.pem folders to force it to recreate real
ones.
If you have a web server on port 80, (other than surgemail), then
you can tell surgemail the path it needs to use:
g_ssl_lets_path "/home/httpd/html/.well-known"
This folder must exist and be writable by the user 'mail', e.g.
mkdir /home/httpd/html/.well-known/acme-challenge
root@mail1:/usr/local/surgemail# chown mail
/home/httpd/html/.well-known/acme-challenge
root@mail1:/usr/local/surgemail# chmod 0777
/home/httpd/html/.well-known/acme-challenge
The rest of the instructions below are for older versions of
surgemail.
Windows Instructions (Linux below)
- Install SurgeMail 7.3f-40 or later!
- Set g_ssl_per_dom "true" if you want certificates for each
domain. (optional)
- Download and uncompress
https://github.com/PKISharp/win-acme/releases -->
c:\letsencrypt
- Modifying /etc/surgemail.ini and adjust g_webmail_port
"80" and g_webmail_secure_port "443" and restart surgemail
- tellmail letsencrypt
- cd \letsencrypt
- \surgemail\lets.cmd
- In surgemail.ini set g_letsencrypt
"C:\ProgramData\win-acme\httpsacme-v01.api.letsencrypt.org"
- tellmail reload
- tellmail letsencrypt_copy
Test the new certificate. Browse to your secure url:
https://mail.your.domain.name
Linux Instructions
- Stop Apache if its running, and uninstall it (unless you want
it, in which case use apache to generate the certificates and
then copy them to surgemail)
- Install letsencrypt certbot if it isn't on your system:
- Install 'cerbot' instructions are here:
https://certbot.eff.org/
- Modifying /etc/surgemail.ini and adjust g_webmail_port
"80" and g_webmail_secure_port "443" and restart
surgemail.
- Set g_ssl_per_dom "true" if you want certificates for each
domain.
- tellmail letsencrypt
- cd (path to certbot)
- source \surgemail\lets.cmd
- set g_letsencrypt "/etc/letsencrypt/live/"
- tellmail letsencrypt_copy
Test the new certificate. Browse to your secure url:
https://mail.your.domain.name