LetsEncrypt

# Using LetsEncrypt with SurgeMail

This pages shows how to use letsencrypt with SurgeMail to create SSL certificates.

## Stop Apache if its running, and uninstall it (unless you want to use it)

        /etc/initld/apache2 stop
    (the above just stops it, lookup your system on google to see how to uninstall properly)

## Install Surgemail

Download from http://netwinsite.com/surgemail/download.htm

## Install letsencrypt certbot if it isn't on your system:

### Linux

https://certbot.eff.org/ will tell you how to install it, just give it your version of linux...

    	For ubunto it told me to do this:
    	    wget https://dl.eff.org/certbot-auto
    	    chmod a+x certbot-auto

### Windows

Download from:
https://github.com/Lone-Coder/letsencrypt-win-simple/releases

Uncompress into a folder, c:\letsencrypt

## Configure SurgeMail to use port 80 and 443, and check remote access.

Modifying /etc/surgemail.ini and adjust g_webmail_port "80" and g_webmail_secure_port "443" and restart surgemail.

        tellmail exit

        /usr/local/surgemail/surgemail_start.sh

## Use letsencrypt/certbot to create your certificates:

Set g_ssl_per_dom "true" if you want certificates for each domain.

Generate the commands from surgemail (7.2d9 and later)
tellmail letsencrypt

This creates a script lets.cmd which you will run from the folder you downloaded letsencrypt to...

### Windows

cd \letsencrypt
\surgemail\lets.cmd

### Linux

cd (path to certbot)
source \surgemail\lets.cmd

### Manually (prior to 7.2d9 on linux)

I'm using the -auto variant as certbot isn't installed, the command line switches are identical... replace YOUR.DOMAIN.NAME with the 'a' record for your server not the domain name (so mail.your.domain.name not your.domain.name)

        ./certbot-auto certonly --webroot -w /usr/local/surgemail/www -d MAIL.YOUR.DOMAIN.NAME

Initially this failed for me as the dns name I had just created took a while to propagate to the letsencrypt systems, if it fails for you it should tell you something useful about why, so read the error you get carefully.

## Copy the certificates to surgemail and restart it.

Define g_letsencrypt in surgemail.ini, replace USERNAME with the username you are using!!!

### Windows

You can find the correct path from the letsencrypt output:

> > C:\lets>letsencrypt --manualhost MAIL.DOMAIN.COM --webroot \surgemail\www
> > Let's Encrypt (Simple Windows ACME Client)
> > Renewal Period: 60
> > Certificate Store: WebHosting
> > ACME Server: https://acme-v01.api.letsencrypt.org/
> > Config Folder: C:\Users\YOURUSERNAME\AppData\Roaming\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.org

g_letsencrypt "\Users\USERNAME\AppData\Roaming\letsencrypt-win-simple\httpsacme-v01.api.letsencrypt.org"

### Linux

g_letsencrypt "/etc/letsencrypt/live/"

###

### Both

Use tellmail to copy the files into surgemail and reload ssl
tellmail letsencrypt_copy

### Manually (prior to 7.2d9 on linux)

        cp /etc/letsencrypt/live/mail3.netwinsite.com/fullchain.pem /usr/local/surgemail/ssl/surge_cert.pem
        cp /etc/letsencrypt/live/mail3.netwinsite.com/privkey.pem /usr/local/surgemail/ssl/surge_priv.pem
        tellmail exit
        /usr/local/surgemail/surgemail_start.sh

## Test the new certificate.

https://mail.your.domain.name

## Setup cron job to renew certificate (linux only).

You may need a cron job to run certbot and copy the certificates. Refer to LetsEncrypt documentation for up to date information on the best practice for this, my belief is a monthly cron job something like this would be reasonable.

    	Crontab entry:   0 0 1 * * /root/monthly.sh

Where /root/monthly.sh contains:

        	#!/bin/bash
        	./certbot-auto certonly --webroot -w /usr/local/surgemail/www -d MAIL.YOUR.DOMAIN.NAME
    	# Next lines not required after 7.2d9 as surgemail will scan and copy the files daily...
    	cp /etc/letsencrypt/live/mail3.netwinsite.com/fullchain.pem /usr/local/surgemail/ssl/surge_cert.pem
        	cp /etc/letsencrypt/live/mail3.netwinsite.com/privkey.pem /usr/local/surgemail/ssl/surge_priv.pem
        	tellmail ssl_reload