I got an Apache running 7 domains on one Ip managed by SNI, and using for a while letsencrypt for https.
Each domain getting is own certs.
Today I would like to add tls to Qmail.
Is there a way to reuse the cert already used by apache for each domain.
Or Should I edit a new certs as: certbot-auto certonly -d domain1.com -d domain1.com -d domain2.com -d domain3.com -d domain4.com
Is there any risk this command destroy the previous cert?
Does this cert will be renew by: /usr/local/sbin/certbot-auto renew --renew-hook "service apache2 graceful" >> /var/log/le-renew.log
That certificate is valid for any server application, so you shouldn't need to get a new one. But your Qmail process might require it in a different format (like the patch I linked to seems to require the private key and certificate chain in a single file, which isn't a combination that's created automatically by Certbot).
This command would likely offer to replace one of the existing certificates because of the overlap in names. If you do want a certificate covering all four names but you don't want it to replace one of the existing ones, you can specify --duplicate or simply choose a distinctive name for the new certificate with --cert-name.
If the hook is already specified when you originally obtained the certificate, it should be remembered and you shouldn't have to give any options after renew. Also, if you used --apache or -i apache and Certbot installed the certificate into Apache for you (i.e., not certonly or --webroot or --standalone or --manual), then Certbot should automatically reload your Apache process for you whenever a certificate is renewed, without requiring a hook. However, if you edited your Apache configuration yourself to configure the certificate, a hook could be useful here.
But my problem is the fact, I have to put one .pem file in /var/qmail/control/, so I have no idea how could i define different cert for different domain
Ok so certbot-auto certonly --duplicate -d domain1.com -d domain1.com -d domain2.com -d domain3.com -d domain4.com
or certbot-auto certonly --cert-name certForMail -d domain1.com -d domain1.com -d domain2.com -d domain3.com -d domain4.com
So with both line It must be any problem to obtain multiple cert for each domain? (1 for apache, 1 for Qmail)?
It seems like the TLS implementation for netqmail might not support choosing among multiple certificates. The TLS protocol itself has a feature called SNI that lets the client indicate which hostname it's trying to connect to, and then the server can choose an appropriate certificate in reply. This is what web servers do with virtual hosts. But netqmail may not have support for this.
In that case, you probably do need to put all of the hostnames into a single certificate. Let's Encrypt will let you list up to 100 names as part of a single certificate. When you specify multiple -d options with Certbot, all of them will be requested as part of the same certificate.
The way that Certbot is structured, each time you run certbot certonly, you request one certificate with whichever named you specified with -d.
I don't understand whether your question is about whether this will cause a problem with the existing certificates, or whether one command is better than the other, or whether you specifically need separate certificates for Apache and Qmail, or something else.
I think that either of these commands is OK, and the second one is probably better because it's more explicit and gives you control over what the certificate is called (it would then be available via /etc/letsencrypt/live/certForMail).
You still don't need to have separate certificates for Apache and Qmail; you could for example reconfigure Apache to use the new combined certificate instead of the previous ones. However, it's also OK to have separate certificates. Either choice is OK.
Certbot would be willing to manage and renew the "certForMail" separately from the existing individual certificates. When you run certbot-auto renew, it will automatically try to renew whichever of the managed certificates are less than 30 days from expiry.
Thanks for your precision about netqmail SNI.
So I would definetly have to get a single certificate for all my domain.
Do you think it could have any impact on inbox delivery rate?
I don’t understand whether your question is about whether this will cause a problem with the existing certificates, or whether one command is better than the other, or whether you specifically need separate certificates for Apache and Qmail, or something else.
Sorry about that.
I mean will cause a problem with the existing certificates, or for renew.
I don't want the get my websites down, for a broken certificate because I play to get cert' for my mail.
So if I create a new certForMail certificate.
the commande-line must renew all certificate.?
the existing apache certificates + the new one?
Well. You use those hostnames as a server to receive / sent emails right?
Let's encrypt provides "Server / TLS certificate", not email certificates...
If you want to use TLS encryption with your QMail server (or any other type of mail server software), you would need to obtain a certificate for that server.