# Tutorial on ejabberd, postfix, dovecot and or nginx with letsencrypt **URL:** \ **Category:** Uncategorized\ **Created:** [December 18, 2015, 8:53pm UTC](https://community.letsencrypt.org/t/tutorial-on-ejabberd-postfix-dovecot-and-or-nginx-with-letsencrypt/7320 "2015-12-18T20:53:10Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Doemela](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/doemela/32/6290_2.png) [@Doemela](https://community.letsencrypt.org/u/Doemela)\ **Post date:** [December 18, 2015, 8:53pm UTC](https://community.letsencrypt.org/t/tutorial-on-ejabberd-postfix-dovecot-and-or-nginx-with-letsencrypt/7320/1 "2015-12-18T20:53:10Z")
I assume you have either Nginx or use Nginx as a Reverse Proxy for Apache **Nginx:** mkdir /usr/share/nginx/letsencrypt mkdir /usr/share/nginx/letsencrypt/public\_html Directive for domain('s) u want cert 4 server { server\_name domain.tld; … location /.well-known/acme-challenge/ { root /usr/share/nginx/letsencrypt/public\_html; … } They u can do ./letsencrypt-auto certonly --agree-tos --rsa-key-size 4096 --renew-by-default -m postmaster@domain.tld --webroot -w /usr/share/nginx/letsencrypt/public\_htm/ -d domain.tld -d domain2.tld -d domain3.tld U now got ur certs **Dovecot/Postfix:** ln -s /etc/letsencrypt/live/domain.tld/privkey.pem /etc/postfix/ssl.key ln -s /etc/letsencrypt/live/domain.tld/fullchain.pem /etc/postfix/ssl.cert edit both configs so they point to key and cert doveadm reload && /etc/init.d/postfix restart **Ejabberd:** Note: /etc/ejabberd/ca.crt I made after dl it from [https://letsencrypt.org/certificates/](https://letsencrypt.org/certificates/) made file and copy/paste it cat /etc/letsencrypt/live/domain.tld/privkey.pem /etc/letsencrypt/live/domain.tld/fullchain.pem /etc/ejabberd/ca.crt \>\> /etc/ejabberd/ejabberd.pem /sbin/ejabberdctl restart This is also done when u renew certs I made script that renews cert for domains and mail/chat services every 60day with Cron – [https://cyberguerrilla.info](https://cyberguerrilla.info) does not store IP addresses, we require https. Cyberguerrilla Anonymous Nexus Autonomous tech collective uses mandatory encryption on every domain or sub-domain it host! ---
**Author:** ![pU0Dz](https://avatars.discourse-cdn.com/v4/letter/p/e8c25b/32.png) [@pU0Dz](https://community.letsencrypt.org/u/pU0Dz)\ **Post date:** [December 30, 2015, 3:23pm UTC](https://community.letsencrypt.org/t/tutorial-on-ejabberd-postfix-dovecot-and-or-nginx-with-letsencrypt/7320/2 "2015-12-30T15:23:40Z")
Hey, I am working on getting ejabberd work with the certificate. Could you explicitly describe, how you obtained “ca.crt”, since I did not find it on the referenced web page. Thanks in advance. ---
**Author:** ![Doemela](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/doemela/32/6290_2.png) [@Doemela](https://community.letsencrypt.org/u/Doemela)\ **Post date:** [December 31, 2015, 12:48pm UTC](https://community.letsencrypt.org/t/tutorial-on-ejabberd-postfix-dovecot-and-or-nginx-with-letsencrypt/7320/3 "2015-12-31T12:48:05Z")
The CA you can dl from [https://letsencrypt.org/certificates/](https://letsencrypt.org/certificates/) see the [txt] [pem] [der] behind the “Intermediate Certificates” make the ca.crt and copy/paste the cert out of [txt] or dl the [pem] and upload it to where u want. Then do: cat /etc/letsencrypt/live/domain.tld/privkey.pem /etc/letsencrypt/live/domain.tld/fullchain.pem /etc/ejabberd/ca.crt \>\> /etc/ejabberd/ejabberd.pem ## Edit /etc/ejabberd/ejabberd.yml [SNIP] listen: ``` port: 5222 module: ejabberd_c2s certfile: "/etc/ejabberd/ejabberd.pem" starttls_required: true protocol_options: - "no_sslv2" - "no_sslv3" ciphers: "HIGH:!3DES:!aNULL:!SSLv2:@STRENGTH" max_stanza_size: 65536 shaper: c2s_shaper access: c2s ``` - port: 5269 module: ejabberd\_s2s\_in [SNIP] - port: 5280 module: ejabberd\_http web\_admin: true http\_bind: true register: true captcha: true certfile: "/etc/ejabberd/ejabberd.pem" tls: true [SNIP] s2s\_use\_starttls: required s2s\_certfile: "/etc/ejabberd/ejabberd.pem" s2s\_protocol\_options: - “no\_sslv2” - “no\_sslv3” s2s\_ciphers: “HIGH:!3DES:!aNULL:!SSLv2:@STRENGTH” [END EDIT] Save the conf and restart ejabberd ---
**Author:** ![billium](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@billium](https://community.letsencrypt.org/u/billium)\ **Post date:** [April 15, 2016, 2:18pm UTC](https://community.letsencrypt.org/t/tutorial-on-ejabberd-postfix-dovecot-and-or-nginx-with-letsencrypt/7320/4 "2016-04-15T14:18:37Z")
Thanks Doemela this was very helpful. The only hard to understand part was the “make the ca.crt” part. I copied [https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt](https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt) into /etc/ejabberd/ca.crt, then followed the cat command as given by you. Then restarted the jabber service, then the clients had to accept the new certificate and it seems to work. Is this what you meant? i.e. taking the text from the link and placing it in a filed called ca.crt. The link is the X3 [txt] ---
**Author:** ![randy](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/randy/32/1214_2.png) [@randy](https://community.letsencrypt.org/u/randy)\ **Post date:** [April 16, 2016, 12:40am UTC](https://community.letsencrypt.org/t/tutorial-on-ejabberd-postfix-dovecot-and-or-nginx-with-letsencrypt/7320/5 "2016-04-16T00:40:36Z")
i use acme\_tiny.py, so i do `cat secrets/domain.key work/chained.pem lets-encrypt-x1-cross-signed.pem > /etc/ejabberd/ejabberd.pem` and i am still stuck in the stone age, so my config is ``` {5222, ejabberd_c2s, [ {access, c2s}, {shaper, c2s_shaper}, {max_stanza_size, 65536}, %%zlib, starttls_required, {certfile, "/etc/ejabberd/ejabberd.pem"} ]}, ``` and i get ``` =ERROR REPORT==== 2016-04-16 00:33:31 === ** State machine <0.644.0> terminating ** Last event in was {xmlstreamelement, {xmlelement,"starttls", [{"xmlns","urn:ietf:params:xml:ns:xmpp-tls"}], []}} ** When State == wait_for_feature_request ** Data == {state,{socket_state,gen_tcp,#Port<0.3281>,<0.643.0>}, ejabberd_socket,"3241108122",s2s_shaper,true,false, false,false, [{certfile,"/etc/ejabberd/ejabberd.pem"}], "xmpp.rg.net",false,undefined, {dict,0,16,16,8,80,48, {[],[],[],[],[],[],[],[],[],[],[],[],[],[],[], []}, {{[],[],[],[],[],[],[],[],[],[],[],[],[],[],[], []}}}, #Ref<0.0.0.12069>} ** Reason for termination = ** {{badmatch,{error,"SSL_CTX_use_PrivateKey_file failed: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch"}}, [{ejabberd_socket,starttls,3,[{file,"ejabberd_socket.erl"},{line,143}]}, {ejabberd_s2s_in,wait_for_feature_request,2, [{file,"ejabberd_s2s_in.erl"},{line,309}]}, {p1_fsm,handle_msg,10,[{file,"p1_fsm.erl"},{line,544}]}, {proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,239}]}]} ``` ---
**Author:** ![Doemela](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/doemela/32/6290_2.png) [@Doemela](https://community.letsencrypt.org/u/Doemela)\ **Post date:** [April 16, 2016, 12:47pm UTC](https://community.letsencrypt.org/t/tutorial-on-ejabberd-postfix-dovecot-and-or-nginx-with-letsencrypt/7320/6 "2016-04-16T12:47:57Z")
> [@Doemela](#): > > cat /etc/letsencrypt/live/domain.tld/privkey.pem /etc/letsencrypt/live/domain.tld/fullchain.pem /etc/ejabberd/ca.crt \>\> /etc/ejabberd/ejabberd.pem The ca.crt is not needed any more: cat /etc/letsencrypt/live/domain.tld/privkey.pem /etc/letsencrypt/live/domain.tld/fullchain.pem \>\> /etc/ejabberd/ejabberd.pem ---
**Author:** ![Doemela](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/doemela/32/6290_2.png) [@Doemela](https://community.letsencrypt.org/u/Doemela)\ **Post date:** [April 16, 2016, 12:50pm UTC](https://community.letsencrypt.org/t/tutorial-on-ejabberd-postfix-dovecot-and-or-nginx-with-letsencrypt/7320/7 "2016-04-16T12:50:42Z")
\*\* {{badmatch,{error,“SSL\_CTX\_use\_PrivateKey\_file failed: error:0B080074:x509 certificate routines:X509\_check\_private\_key:key values mismatch”}}, Try it with this cat /etc/letsencrypt/live/domain.tld/privkey.pem /etc/letsencrypt/live/domain.tld/fullchain.pem \>\> /etc/ejabberd/ejabberd.pem ---
**Author:** ![Doemela](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/doemela/32/6290_2.png) [@Doemela](https://community.letsencrypt.org/u/Doemela)\ **Post date:** [April 16, 2016, 12:54pm UTC](https://community.letsencrypt.org/t/tutorial-on-ejabberd-postfix-dovecot-and-or-nginx-with-letsencrypt/7320/8 "2016-04-16T12:54:26Z")
> [@Doemela](#): > > The CA you can dl from [Chain of Trust - Let's Encrypt](https://letsencrypt.org/certificates/) see the [txt] [pem] [der] behind the "Intermediate Certificates" make the ca.crt and copy/paste the cert out of [txt] or dl the [pem] and upload it to where u want. > > Then do: > cat /etc/letsencrypt/live/domain.tld/privkey.pem /etc/letsencrypt/live/domain.tld/fullchain.pem /etc/ejabberd/ca.crt \>\> /etc/ejabberd/ejabberd.pem > > ## Edit /etc/ejabberd/ejabberd.yml [SNIP] listen: > > ``` > port: 5222 > module: ejabberd_c2s > certfile: "/etc/ejabberd/ejabberd.pem" > starttls_required: true > protocol_options: > - "no_sslv2" > - "no_sslv3" > ciphers: "HIGH:!3DES:!aNULL:!SSLv2:@STRENGTH" > max_stanza_size: 65536 > shaper: c2s_shaper > access: c2s > > ``` > > - port: 5269 > module: ejabberd\_s2s\_in > [SNIP] > - port: 5280 > module: ejabberd\_http > web\_admin: true > http\_bind: true > register: true > captcha: true > certfile: "/etc/ejabberd/ejabberd.pem" > tls: true > [SNIP] > s2s\_use\_starttls: required > s2s\_certfile: "/etc/ejabberd/ejabberd.pem" > s2s\_protocol\_options: > - "no\_sslv2" > - "no\_sslv3" > > s2s\_ciphers: "HIGH:!3DES:!aNULL:!SSLv2:@STRENGTH" > > [END EDIT] Save the conf and restart ejabberd This is enough for ejabberd: cat /etc/letsencrypt/live/domain.tld/privkey.pem /etc/letsencrypt/live/domain.tld/fullchain.pem \>\> /etc/ejabberd/ejabberd.pem ---
**Author:** ![randy](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/randy/32/1214_2.png) [@randy](https://community.letsencrypt.org/u/randy)\ **Post date:** [April 16, 2016, 8:54pm UTC](https://community.letsencrypt.org/t/tutorial-on-ejabberd-postfix-dovecot-and-or-nginx-with-letsencrypt/7320/9 "2016-04-16T20:54:10Z")
for the record, with acme\_tiny, what worked was `cat work/signed.crt secrets/domain.key work/chained.pem > /etc/ejabberd/ejabberd.pem` ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [July 15, 2020, 11:22am UTC](https://community.letsencrypt.org/t/tutorial-on-ejabberd-postfix-dovecot-and-or-nginx-with-letsencrypt/7320/10 "2020-07-15T11:22:30Z")
A post was merged into an existing topic: [Ejjabberd + windows + letsencrypt certificate](https://community.letsencrypt.org/t/ejjabberd-windows-letsencrypt-certificate/128447/5) ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [July 15, 2020, 11:22am UTC](https://community.letsencrypt.org/t/tutorial-on-ejabberd-postfix-dovecot-and-or-nginx-with-letsencrypt/7320/11 "2020-07-15T11:22:49Z")