ISPconfig - restart postfix and dovecot on letsencrypt certificate renewal

Discussion in 'Server Operation' started by tom.1, Jun 1, 2024.

  1. tom.1

    tom.1 New Member

    My server is setup according to the perfect server guide with ISPconfig debian apache postfix dovecot. DNS is done externally.

    In my setup a dedicated domain handles all provided services via subdomains. For mail services it uses, and

    To provide SSL for the mail services I have created subdomains in ISPconfig and included them in the main domain's letsencrypt-certificate. I didn't want to have a wildcard-certificate for these services.
    The server certificate and key in /var/www/ are symlinked to /etc/dovecot/private/dovecot.key and -.pem for dovecot and /etc/postfix/smtpd.cert and -.key for postfix.

    The problem was that upon certificate renewal dovecot and postfix needed to be restarted manually in order to deliver the renewed certificate.

    Is there a way build into ISPconfig that allows you to restart selected services if the le-certificate is renewed? I have tried to restart dovecot and postfix with a cronjob but it didn't hit the sweet spot. I had to restart them manually nevertheless.

    Since ISPconfig uses to handle letsencrypt-certificates I found out that there is a parameter --reloadcmd in the script which tells the script what other comands to invoke after renewing the certificate.
    Seeing this I've tried to modify the domain configuration for the script, i.e. changing the --reloadcmd parameter to include reloading postfix and dovecot.

    /root/ --home "/root/" --info -d
    you can see that by default Le_ReloadCmd is set to "systemctl force-reload apache2.service"
    Unfortunately the parameter in the domain's conf-file (/root/ is BASE64 encoded. You can't simply type in new commands.

    If you install the certificate manually you can extend this parameter. I did this with the following command:

    /root/ --home "/root/" --install-cert -d --key-file "/var/www/clients/client1/web1/ssl/" --fullchain-file "/var/www/clients/client1/web1/ssl/" --reloadcmd "systemctl force-reload apache2.service;systemctl reload postfix;systemctl reload dovecot"
    According to a post in the letsencrypt it should be possible to use multiple commands in the parameter --reloadcmd this way.
    Looking at the files in /root/ this only updated the file

    Now my question: I assume that changing things for this domain in ISPconfig e.g. adding a new subdomain will revert these changes. But will ISPconfig still be able to manage LE-certificates for this domain? Will this be persistent or will an update on any other domain controlled by ISPconfig revert these changes?
  2. till

    till Super Moderator Staff Member ISPConfig Developer

Share This Page