creating letsencrypt records for email subdomains like mail, imap, etc.?

Hello.
Is it possible to have the system fetch ssl certs from letsencrypt for email domains? for example i'd like mail.domain.com imap.domain.com, etc.
Each time i add a domain it should add these certs.

Anyone know what i might be missing? I'm running the latest ispconfig 3.3 on debian 12

 

So how is this done in larger environments with different clients and domains? Does everyone just use the system servers?

Thanks.

 

and to do the le cert for the main name you add subdomains in the main server cert for things like imap, mail, etc?

 

Hello,

I know ISPConfig automatically creates certificates for port 8080 (interface), mail, and FTP. Is it possible to permanently add a Subject Alternative Name (SAN) to the Common Name certificate?

I want to use this to simplify automatic email account setup on devices. In Outlook, the outgoing server is often set to smtp.domain, but that does not match serverx.domain and therefore causes a certificate mismatch.

I managed to make this work by adding the following:

• In serverx.domain.csr.conf:
  subjectAltName=DNS:serverx.domain,DNS:smtp.domain
  
  
• In serverx.domain.conf:
  Le_Alt='smtp.domain'

Then I ran:


acme.sh --issue \
-d serverx.domain \
-d smtp.domain \
--keylength 4096 \
--webroot /usr/local/ispconfig/interface/acme \
--force
SUCCESS=1 /usr/local/ispconfig/server/scripts/letsencrypt_renew_hook.sh

Because this did not update the certificate in the correct location, I also updated the interface certificate in /usr/local/ispconfig/interface/ssl/:


acme.sh --install-cert -d serverx.domain \
--key-file /usr/local/ispconfig/interface/ssl/ispserver.key \
--fullchain-file /usr/local/ispconfig/interface/ssl/ispserver.crt \
--reloadcmd "SUCCESS=1 /usr/local/ispconfig/server/scripts/letsencrypt_renew_hook.sh"

This produces the expected result:


openssl x509 -in /usr/local/ispconfig/interface/ssl/ispserver.crt -noout -ext subjectAltName

Output:

• DNS:serverx.domain
  
  
• DNS:smtp.domain

 

This was all you had to do.
And afterwards do a force renew with acme.sh from the command line.
Nothing else needed to be done as other settings in the conf file should have been correct already.
Now I'm not so sure.

 

After an ISPconfig update with ssl renew its gone. So i think there in more to be done two make this work.