Did the letsencript option on the create certificate for mail server?

Discussion in 'General' started by Cristiangd.cl, Jun 8, 2023.

  1. Cristiangd.cl

    Cristiangd.cl New Member

    Did the certificate for the mail domain created by the letsencript option of the site section or has to be created manually?
    Thanks
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    The Let's Encrypt SSL cert which gets created at install time by ISPConfig for the hostname of the system is used by the ISPConfig GUI, the mail system and FTP.
     
  3. ahrasis

    ahrasis Well-Known Member HowtoForge Supporter

    No. No certificate is created for mail domain that way. Currently ISPConfig only supports the server FQDN with LE certs and they were created as explained by @till above.
     
  4. Cristiangd.cl

    Cristiangd.cl New Member


    Can this certificate be updatred to the actual server name?
     
  5. Cristiangd.cl

    Cristiangd.cl New Member

    or better can be replaced by a manually created mutidomain certificate only for server, mail and ftp. leaving the web certificateds to be handled by ispconfig?
     
  6. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    The certificate created by ISPConfig install is for the actual server name.
    Each website gets it's own certificate when it is ticked on in website settings.
    Is there an actual problem on your server with certificates? Is it just now installed or did the problem appear recently?
    One way to mess up the ISPConfig certificate system is to create a website that has same name as server FQDN. So do not do that. Another way is if server FQDN is domain only, like mycompany.tld instead of hostname.mycompany.tld, so do not do that either.
     
    ahrasis likes this.
  7. till

    till Super Moderator Staff Member ISPConfig Developer

    Like @Taleman mentioned, the ssl cert is issued for the server name, so it should be correct unless you configured the server with a wrong name initially. in this case, you can run and ispconfig update with:

    ispconfig_update.sh --force

    and let the updater issue a new SSL cert after you changed the server name. Besides that, you can use a custom SSL cert of course, the SSL cert is in /usr/local/ispconfig/interface/ssl/ folder. There is also a method to use a website SSL cert as described here: https://www.howtoforge.com/securing...server-with-a-valid-lets-encrypt-certificate/ But having a website with server hostname can cause issues as @Taleman pointed out, so using a website is only an option of the site is not the server hostname.
     
  8. Cristiangd.cl

    Cristiangd.cl New Member

    Im updating the hardware and OS from an obsolete centos 6 to Debian 11.
    When I migrate from old server give the new server asign a temporary fqdn. So after install Ispconfig on the new server the certificate was issued with the temporary fqdn. after migrate I unplug the old machine and rename new machine and reassign IP.
    This machine is the web, and mail server for several domains.
    ispconfig_update.sh --force update the certifice to actual server name however email clients keep claiming cannot verify server identity since it not shows the mail server id. older server I was ussinng a previous version of https://www.howtoforge.com/securing...server-with-a-valid-lets-encrypt-certificate/ this.
    So in order to have a certificate for mail I will ahve to create a multidomain certificate with the updated procedure.


    Thanks you all have been very helpful.
     
  9. ahrasis

    ahrasis Well-Known Member HowtoForge Supporter

    Your clients must use your server FQDN and not their own domains. Check your server LE certs just to ensure if there is any issue.
     
    Last edited: Jun 13, 2023

Share This Page