Let's Encrypt certificates are automatic: the built-in ACME v2 client
-
hMailServer has an ACME v2 client built in (RFC 8555). It obtains a free certificate, installs it, assigns it to your TLS ports, renews it before expiry and reloads it. No restart, no scheduled task, no external client.
Configure it under Settings → Security → Certificates (ACME), or in
hMailServer.INI:AcmeEnabled=1 [email protected] AcmeDomains=mail.yourcompany.com,mta-sts.yourcompany.com,autoconfig.yourcompany.com AcmeHttpPort=80 AcmeReuseKey=1AcmeEnabledships as0.AcmeDirectoryUrldefaults tohttps://acme-v02.api.letsencrypt.org/directory.Two requirements. Port 80 must be reachable from the internet, because that is how the http-01 challenge proves you control the name. Every name in
AcmeDomainsmust already resolve to this server before you switch it on. If you also host MTA-STS or client autoconfiguration, putmta-sts.<domain>,autoconfig.<domain>andautodiscover.<domain>inAcmeDomainsso one certificate covers them.After issuance. The server creates or updates a certificate record named
ACME (automatic)and assigns it to every TLS-enabled listener that has none of its own, logging each assignment. A listener the assignment could not be saved for is reported as a High 6100 rather than logged as a success, because a port left without a certificate accepts no TLS at all. That is the error to alert on.Renewal. The renewal window is two thirds of the certificate lifetime, plus ARI. That is why there is nothing left to schedule. Files live in
Data\ACMEon Windows and/var/lib/hmailserver/ACME/on Linux: the account key,fullchain.pemandprivkey.pem. Back that directory up with the rest ofData\. If a restore misses it the client re-issues, but the new key invalidates any TLSA records you have published.Leave
AcmeReuseKey=1. Keeping the same private key across renewals is what keeps published TLSA records valid.Linux. Port 80 works without root.
CAP_NET_BIND_SERVICEon the unit is what allows the bind. The default certificate directory is<DataFolder>/ACME, which is insideReadWritePaths. PointAcmeCertificateDirectoryelsewhere and you must add that path toReadWritePathswith a drop-in, or issuance fails on a read-only filesystem.If it never worked for you. The built-in client had never once succeeded against real Let's Encrypt until 6.2.24 (#34). Boulder pretty-prints its JSON and the challenge locator searched for the compact spelling. 6.2.25 then fixed issuance and renewal ending the process (#93). If you gave up on this on an older build, it is worth another look.
Another CA. Leave
AcmeEnabled=0, add the PEM certificate and key under Settings → Security → SSL certificates, then assign it to ports under Settings → Network → TCP/IP ports. On Linux, an external client that replaces the PEM files in place needsPOST /api/v1/server/reinitializeor a restart before the new files are served.Chapter 9, encryption and certificates: https://www.progressiverobot.com/hmailserver-documentation/#9-encryption-and-certificates
Report problems: https://gitlab.com/Progressiverobot/hmailserver
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login