LetsEncrypt

# Using LetsEncrypt with SurgeMail

This pages shows how to use letsencrypt with SurgeMail to create SSL certificates.

## Stop Apache if its running, and uninstall it (unless you want to use it)

        /etc/initld/apache2 stop
    (the above just stops it, lookup your system on google to see how to uninstall properly)

## Install Surgemail

Download from http://netwinsite.com/surgemail/download.htm

## Install letsencrypt certbot if it isn't on your system:

https://certbot.eff.org/ will tell you how to install it, just give it your version of linux...

    	For ubunto it told me to do this:
    	    wget https://dl.eff.org/certbot-auto
    	    chmod a+x certbot-auto

## Configure SurgeMail to use port 80 and 443, and check remote access.

Modifying /etc/surgemail.ini and adjust g_webmail_port "80" and g_webmail_secure_port "443" and restart surgemail.

        tellmail exit

        /usr/local/surgemail/surgemail_start.sh

## Use certbot to create your certificates:

I'm using the -auto variant as certbot isn't installed, the command line switches are identical... replace YOUR.DOMAIN.NAME with the 'a' record for your server not the domain name (so mail.your.domain.name not your.domain.name)

        ./certbot-auto certonly --webroot -w /usr/local/surgemail/www -d MAIL.YOUR.DOMAIN.NAME

Initially this failed for me as the dns name I had just created took a while to propagate to the letsencrypt systems, if it fails for you it should tell you something useful about why, so read the error you get carefully.

## Copy the certificates to surgemail and restart it.

        cp /etc/letsencrypt/live/mail3.netwinsite.com/fullchain.pem /usr/local/surgemail/ssl/surge_cert.pem
        cp /etc/letsencrypt/live/mail3.netwinsite.com/privkey.pem /usr/local/surgemail/ssl/surge_priv.pem
        tellmail exit
        /usr/local/surgemail/surgemail_start.sh

## Test the new certificate.

https://mail.your.domain.name

## Setup cron job to renew certificate.

You may need a cron job to run certbot and copy the certificates. Refer to LetsEncrypt documentation for up to date information on the best practice for this, my belief is a monthly cron job something like this would be reasonable.

    	Crontab entry:   0 0 1 * * /root/monthly.sh

Where /root/monthly.sh contains:

        #!/bin/bash
        ./certbot-auto certonly --webroot -w /usr/local/surgemail/www -d MAIL.YOUR.DOMAIN.NAME
        cp /etc/letsencrypt/live/mail3.netwinsite.com/fullchain.pem /usr/local/surgemail/ssl/surge_cert.pem
        cp /etc/letsencrypt/live/mail3.netwinsite.com/privkey.pem /usr/local/surgemail/ssl/surge_priv.pem
        tellmail ssl_reload