$$SSL Configuration$$

||include||style.htm||
||include||body.htm||

$$Current certificate$$ ||ifdef||cert_untrusted|| ($$UNTRUSTED$$) ||endif|| ||ifdef||ssl_per_domain|| $$for domain$$: | ||else|| $$for server$$ ||ssl_host|| ||endif||

    	$$Domain (Common Name)$$		: ||cert_domain||
    	Alternative URLs		: ||cert_altname||
    	$$Issued by$$			: ||cert_issuer||
    	$$Valid until$$			: ||cert_valid||
    	$$Organization Name$$ 		: ||cert_organisation||
    	$$Organizational Unit Name$$ 	: ||cert_unit||
    	$$Locality Name$$ 			: ||cert_city||
    	$$State or Province Name$$  	: ||cert_state||
    	$$Country Code$$ 			: ||cert_country||
    	Extra info			: ||cert_info||
    	||ssl_warning||
    	||ssl_log||

||ifdef||show_csr||

### CSR Certificate Signing Request

||do_show_sslcsr||

Copy the above text and paste into the certification providers website when asked!. ||endif||

### How to get a signed certificate

- Click on 'Create CSR', if you have never done this before, and give the details of your server.
- Click on 'Show CSR' and copy the code.
- Go to your favourite certificate registry and request a signed certificate e.g. https://www.startssl.com, when asked tell it you have your own CSR and paste it into the form they provide.
- They will then give you a signed certificate and intermediate certificates, ask for 'Apache' or 'Other' format.
- Upload the two files using the buttons above...

### Warning:

If your certificate doesn't match the current private key, or is miss formatted etc, then you may loose connection to this page when you press 'save changes', instead use the non ssl admin port: http://your.server:7026, examine mail.err for the cause, remove ssl/surge_cert.pem and restart surgemail to recreate a working unsigned certificate!

### Manual Installation of Certificates - And debugging bad certificates....

You can install your certificate manually by replacing the file ssl/surge_cert.pem and place the intermediate certifictes in surge_chain.pem then restart surgemail.
If your certificate was created from a different private key then also replace ssl/surge_priv.pem. If your certificate is faulty in any way ssl will not work, in that case examine mail.err to find the cause, and remove surge_cert.pem and restart surgemail to recreate an unsigned but working certificate.

### LetsEcrypt

Lets encrypt is a free service to create SSL certificates automatically and update them each month, to use it see the instructions here.