SSL with letsencrypt

elipso

Hi there, i have problem setup SSL for Mailcow UI and SOGo.

Have running linux debian where is installed apache2. There is running main website with domain.com and SSL letsencrypt.

On that same HW i installed Mailcow.

Mailcow is runnig, but when i open domain.com:8443 its unsecured.

I have installed certificate in folders /etc/letsencrypt/live/domain.com/certs

How do I force mailcow to take the certificate from this folder.

When I try it through apache2 and virtualhost:8443 I have no success

esackbauer

https://docs.mailcow.email/post_installation/firststeps-ssl/#how-to-use-your-own-certificate
you have to copy the certificate to that folder.
You have to write a script that copies to that folder once lets encrypt has renewed.

Regarding Apache config:
https://docs.mailcow.email/post_installation/reverse-proxy/r_p-apache24/

elipso

esackbauer

Hi, i have inside /etc/letsencrypt/live/domain.com files: cert.pm, chain.pm, fullchain.pm, privkey.pm

When i copy that files to /data/assets/ssl/

And restart services, there is still problem

esackbauer

elipso
/data/assets/ssl would be the wrong folder…
it is meant the folder underneath your mailcow installation folder.

And did you read this?

save the combined certificate (containing the certificate and intermediate CA/CA if any) to data/assets/ssl/cert.pem and the corresponding key to data/assets/ssl/key.pem

So that means do not just copy the 3 files, but copy only the fullchain and keyfile and rename them properly. Isnt that obvious?

mwlistscom

elipso

Because none answered – for the googlers – You needed to copy the fullchain to cert.pm –

letsencrypt genrates these files:
-rw-r–r– 1 root root 6435 Mar 25 08:46 mailcow.all.pem
-rw-r–r– 1 root root 2431 Mar 25 08:46 mailcow.ca
-rw-r–r– 1 root root 2329 Mar 25 08:46 mailcow.crt
-rw-r–r– 1 root root 4760 Mar 25 08:46 mailcow.fullchain
-rw-r–r– 1 root root 1675 Mar 25 08:46 mailcow.key

So you were missing -

mailcow.fullchain to cert.pem

Then verify with https://www.checktls.com/TestReceiver

elipso

esackbauer

Of course I copied it to my installation folder….
/opt/mailcow-dockerized/data/assets/ssl

Of course, I copied only those on the first try. And renamed.
When it didn’t work, I tried to copy all of them. It still didn’t help.

esackbauer

mwlistscom Because none answered – for the googlers – You needed to copy the fullchain to cert.pm –

I answered this already back then:

esackbauer So that means do not just copy the 3 files, but copy only the fullchain and keyfile and rename them properly.

esackbauer

Did you do docker compose up -d instead of only restarting the services?
Are you using wildcard certificates?

elipso

esackbauer

Yes i try

docker compose up -d

I tried restarts the entire server
I use https://letsencrypt.org/docs/