Must a separate virtual host be made for mail subdomains?

If I were in your situation, I would do the following:

  1. A separate certificate dedicated to mail.example.com; this will isolate issues with your mail and web services from each other. If mail messes up during renewal, it should not bring down your web systems.

  2. A dummy vhost for HTTP-01 OR (preferably) DNS-01 authentication via acme-dns for mail.example.com

You can re-use your mail.example.com certificate between SMTP server and web server if you wish. If you don't end up hosting a webmail system, or anything else, on that domain then you won't need to run any web services on it.

In this situation though:

  1. You need the mail.example.com certificate for your SMTP services
  2. The easiest way to get that certificate, is by setting up a virtualhost for mail.example.com and using the HTTP-01 challenge
3 Likes

Thank you all for the responses so far. If it helps, the person I'm working with has informed me that we do not intend for the same web server to be used to serve both mail and regular web service content, and the email will definitely be on a different subdomain.

3 Likes

If they both share the same external IP, then you will have to compensate.
If they each have their own external IP, then treat them as separate systems and things will work easier.

2 Likes

What should I put for ServerAlias and ServerAdmin? My ServerName would be mail.sangstar-mail.tk I would assume.

1 Like

If you are actually using a separate server for mail..... Then you don't technically need to configure a ServerAlias in this case. Just use mail.sangstar-mail.tk Don't just make one up if it doesn't exist. And IMHO don't use the same name that is configured as ServerName..

You should, however, create email aliases for "root" and/or your main email account for "webmaster@, abuse@, etc.

Quotes from the stack:

There's no reason to create them all as individual e-mail accounts. You can just set up forwarders that lead to a generic site.admin@ account and set up a filter for that in your mail client to keep the noise isolated.

You'll want them, because:

  • webmaster@ is where good natured people do things like report broken links, it happens more than you'd think!
  • abuse@ is nice to have, it sometimes keeps people from going directly to your host / data center / bandwidth provider in the event that someone found a way to use your server to send SPAM.
  • postmaster@ is handy to check, and make sure root's mail is also sent there, at the least it will show you if your mail server is configured incorrectly, it will also catch bounces that let you know you have a spammer.
  • hostmaster@ is strongly recommended by RFC2142 as a well-known mailbox name for your DNS zone's SOA record.
2 Likes

As an update, I just created the mail.sangstar-mail.tk.conf file, with the following information:

<VirtualHost *:80>
        ServerName mail.sangstar-mail.tk
        ServerAdmin sangstar@sangstar-mail.tk

        DocumentRoot /var/www/mail.sangstar-mail.tk/html
        <Directory /var/www/mail.sangstar-mail.tk/html>
                Options -Indexes +FollowSymLinks
                DirectoryIndex index.html
                AllowOverride All
                Require all granted
        </Directory>

        ErrorLog /var/www/mail.sangstar-mail.tk/logs/error.log
        CustomLog /var/www/mail.sangstar-mail.tk/logs/access.log combined
</VirtualHost>

Then following the guide I originally posted here, I put:

**sangstar@mail** : **~** $ sudo systemctl reload apache2

Job for apache2.service failed.

See "systemctl status apache2.service" and "journalctl -xe" for details.

I tried systemctl status apache2.service which said:

● apache2.service - The Apache HTTP Server
     Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2021-01-21 13:09:06 UTC; 5 days ago
       Docs: https://httpd.apache.org/docs/2.4/
    Process: 189995 ExecStart=/usr/sbin/apachectl start (code=exited, status=0/SUCCESS)
    Process: 233224 ExecReload=/usr/sbin/apachectl graceful (code=exited, status=1/FAILURE)
   Main PID: 189999 (apache2)
      Tasks: 10 (limit: 1137)
     Memory: 59.4M
     CGroup: /system.slice/apache2.service
             ├─189999 /usr/sbin/apache2 -k start
             ├─228362 /usr/sbin/apache2 -k start
             ├─228363 /usr/sbin/apache2 -k start
             ├─228364 /usr/sbin/apache2 -k start
             ├─228365 /usr/sbin/apache2 -k start
             ├─228366 /usr/sbin/apache2 -k start
             ├─228465 /usr/sbin/apache2 -k start
             ├─228572 /usr/sbin/apache2 -k start
             ├─228573 /usr/sbin/apache2 -k start
             └─228574 /usr/sbin/apache2 -k start

Which I'm unsure what to make from. I figured I'd carry on and try sudo apache2ctl configtest which outputted:

AH00112: Warning: DocumentRoot [/var/www/mail.sangstar-mail.tk/html] does not exist

(2)No such file or directory: AH02291: Cannot access directory '/var/www/mail.sangstar-mail.tk/logs/' for error log of vhost defined at /etc/apache2/sites-enabled/mail.sangstar-mail.tk.conf:1

AH00014: Configuration check failed

Action 'configtest' failed.

The Apache error log may have more information.

For some reason, /var/www/mail.sangstar-mail.tk/logs/error.log does not exist.

Also, I'm not sure what I'd put in for this if I were to make a mail.example.com-le-ssl.conf file:

 <VirtualHost *:443>
         ServerName mail.example.com
"all that stuff"
2 Likes

Just make the two directories:

mkdir -p /var/www/mail.sangstar-mail.tk/html
mkdir -p /var/www/mail.sangstar-mail.tk/logs
3 Likes

That seems to have worked. With that, here's what I've inputted. The redirecting issue seems to remain, and is still unable to find the vhost, despite Site mail.sangstar-mail.tk already enabled

**sangstar@mail** : **~** $ sudo systemctl reload apache2

**sangstar@mail** : **~** $ sudo apache2ctl configtest

Syntax OK

**sangstar@mail** : **~** $ sudo nano /etc/apache2/sites-available/mail.sangstar-mail.tk.conf

**sangstar@mail** : **~** $ sudo letsencrypt --apache -d sangstar-mail.tk,www.sangstar-mail.tk,mail.sangstar-mail.tk --email sangstar@sangstar-mail.tk

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Plugins selected: Authenticator apache, Installer apache

Cert not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry.

(ref: /etc/letsencrypt/renewal/sangstar-mail.tk.conf)

What would you like to do?

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

1: Attempt to reinstall this existing certificate

2: Renew & replace the cert (limit ~5 per 7 days)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 1

Keeping the existing certificate

Deploying Certificate to VirtualHost /etc/apache2/sites-enabled/sangstar-mail.tk-le-ssl.conf

Deploying Certificate to VirtualHost /etc/apache2/sites-enabled/sangstar-mail.tk-le-ssl.conf

Deploying Certificate to VirtualHost /etc/apache2/sites-enabled/sangstar-mail.tk-le-ssl.conf

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

1: No redirect - Make no further changes to the webserver configuration.

2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for

new sites, or if you're confident your site works on HTTPS. You can undo this

change by editing your web server's configuration.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

Failed redirect for sangstar-mail.tk

Unable to set enhancement redirect for sangstar-mail.tk

Unable to find corresponding HTTP vhost; Unable to create one as intended addresses conflict; Current configuration does not support automated redirection

**IMPORTANT NOTES:**

**- We were unable to set up enhancement redirect for your server,**

**however, we successfully installed your certificate.**

- Congratulations! Your certificate and chain have been saved at:

/etc/letsencrypt/live/sangstar-mail.tk/fullchain.pem

Your key file has been saved at:

/etc/letsencrypt/live/sangstar-mail.tk/privkey.pem

Your cert will expire on 2021-04-21. To obtain a new or tweaked

version of this certificate in the future, simply run certbot again

with the "certonly" option. To non-interactively renew *all* of

your certificates, run "certbot renew"

Please show:
sudo letsencrypt certificates

1 Like
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: mail.sangstar-mail.tk
    Domains: mail.sangstar-mail.tk
    Expiry Date: 2021-04-20 13:37:17+00:00 (VALID: 83 days)
    Certificate Path: /etc/letsencrypt/live/mail.sangstar-mail.tk/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/mail.sangstar-mail.tk/privkey.pem
  Certificate Name: sangstar-mail.tk
    Domains: sangstar-mail.tk mail.sangstar-mail.tk www.sangstar-mail.tk
    Expiry Date: 2021-04-21 18:34:53+00:00 (VALID: 85 days)
    Certificate Path: /etc/letsencrypt/live/sangstar-mail.tk/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/sangstar-mail.tk/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 Like

You already have two valid certs that cover the mail name:

Looks like you could just do with the second one and delete the first one.
If so, then:
sudo letsencrypt delete --certname mail.sangstar-mail.tk

And keep just:

Then you might want to confirm that it can be renewed:
sudo letsencrypt renew --dry-run

1 Like

Does it functionally matter whether I deleted the first one or not? And why was I getting the error message I was getting/why is it okay to ignore?

1 Like

I would ignore the previous problems/error messages and move forward from where we are now.
The first cert was issued one week ago.
You have made many changes since then (and before).
I can't be 100% sure why anything happened now.
I can be 100% sure you have a cert.
And we can test that it can be renewed now (with your current config).
If that fails, then we need to modify it.
If it works, then we can stop fixing it - LOL

Doesn't matter; any cert with the name you need on it would work.

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.