Renew certificate for mail

[laureanojm]

@jmorahan

What version of certbot are you using? You may need to update it in order to use the certbot certificates command. Updating it via apt-get should do the trick - the certbot certificates subcommand was added in 0.10.0 and the latest version in jessie-backports and stretch is 0.10.2.

If that works, you can use certbot certificates to get a list of the certificates currently on your server. This should help you to determine if you have one that’s currently valid for the domain name you want.

If you do, ensure your mail server configuration references the correct certificate, and reload the mail server. If you need help with that, please share your existing mail server configuration.

If you can’t find a valid certificate and still need to renew, note that the “manual” plugin that your co-worker apparently used originally is not compatible with the certbot renew command (at least not without some extra configuration and scripting). However you can force it to go through the manual process again by running certbot certonly --manual and selecting/entering the same set of domains that are on the cert that needs to be renewed.

Alternatively, you might try a different plugin; since you seem to have Apache on this server you could try: certbot certonly --apache (the certonly here prevents certbot from trying to install the certificate in Apache, which you don’t want if it’s only for the mail server, but you can still use Apache to obtain the certificate). An advantage of this approach is that unlike --manual, the --apache plugin does work with the certbot renew command so if you get that working, you’ll be able to renew the certificate automatically in the future.

You can also automate the step of reloading the mail server by using the --renew-hook option (later versions of certbot use --deploy-hook which is almost the same but better)

For example:

sudo certbot certonly --apache -d smtp.estudioines.com --renew-hook "service postfix reload"

If you’re using certbot 0.10.0 or later, this will be remembered and run automatically on renewal so you don’t even have to reload the mail server manually. If you’re using an older version, you’ll have to add that option to the cron job instead (but I really do recommend upgrading if at all possible).

After debian update and certbot re install:

certbot certificates

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Revocation status for /etc/letsencrypt/live/smtp.mydomain.com/cert.pem is unknown

---

Found the following certs:
Certificate Name: mail.mydomain.com
Domains: mail.mydomain.com
Expiry Date: 2018-02-22 00:00:51+00:00 (VALID: 83 days)
Certificate Path: /etc/letsencrypt/live/mail.mydomain.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/mail.mydomain.com/privkey.pem
Certificate Name: imap.mydomain.com
Domains: imap.mydomain.com
Expiry Date: 2018-02-22 00:09:00+00:00 (VALID: 83 days)
Certificate Path: /etc/letsencrypt/live/imap.mydomain.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/imap.mydomain.com/privkey.pem
Certificate Name: webmail.mydomain.com
Domains: webmail.mydomain.com
Expiry Date: 2018-02-22 15:03:38+00:00 (VALID: 84 days)
Certificate Path: /etc/letsencrypt/live/webmail.mydomain.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/webmail.mydomain.com/privkey.pem
Certificate Name: smtp.mydomain.com
Domains: smtp.estudioines.com
Expiry Date: 2017-11-12 16:16:00+00:00 (INVALID: EXPIRED)
Certificate Path: /etc/letsencrypt/live/smtp.mydomain.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/smtp.mydomain.com/privkey.pem