Configure Lets Encrypt Cert in Postfix in a RHEL7 server
============================================================================================
1. Install Apache Web Server
--------------------------------------
$ sudo yum groupinstall -y "Web Server"
$ sudo vim /etc/hosts
- add: 1.2.3.4 host.example.com example.com
$ sudo vim /etc/hostname
- add: host.example.com
$ sudo vim /etc/httpd/conf/httpd.conf
- set the ServerName directive in the /etc/httpd/conf/httpd.conf file
$ sudo vim /etc/httpd/conf.d/ssl.conf
- set the ServerName directive in the /etc/httpd/conf.d/ssl.conf file
$ sudo hostname -f /etc/hostname
$ sudo systemctl enable httpd
$ sudo systemctl start httpd
+ Open port 80 and 443 in AWS firewall rules in your AWS/EC2 instance console
+ Make sure you have installed the latest version of OpenSSL in your server.
$ sudo yum update openssl
+ Tune Apache 2.4 TLS configuration
$ sudo vim /etc/httpd/conf.d/ssl.conf
- SSLProtocol TLSv1.2
- SSLHonorCipherOrder On
- SSLCipherSuite "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES128:RSA+AESGCM!aNULL:!MD5:!DSS:!LOW:!MEDIUM"
- Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
- Header always set X-Frame-Options DENY
- Header always set X-Content-Type-Options nosniff
# Requires Apache >= 2.4
- SSLCompression off
$ sudo apachectl restart
2. Install Lets Encrypt CA - CertBot
--------------------------------------
$ sudo yum-config-manager --enable rhui-REGION-rhel-server-extras
$ sudo yum-config-manager --enable rhui-REGION-rhel-server-optional
$ sudo yum repolist all
$ wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
$ sudo rpm -Uvh epel-release-latest-7*.rpm
$ sudo yum install python-certbot-apache
$ sudo certbot --apache
+ Your certificate and chain have been saved at /etc/letsencrypt/live/<domain>
+ Lets encrypt certificates expire 90 days after they were issue.
+ To obtain a new or tweaked version of this certificate in the future,
simply run certbot again with => certbot --apache certonly
+ To non-interactively renew *all* of your certificates,
run with => certbot renew --dry-run
+ If that appears to be working correctly, you can arrange for automatic renewal
by adding a cron or systemd job which runs the
following => certbot renew --quiet
3. Install Postfix
$ sudo yum install postfix
$ sudo /etc/postfix/main.cf
- myhostname = host2.ite.lat
- mydomain = ite.lat
- myorigin = $mydomain
- inet_interfaces = $myhostname, localhost
- mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
mail.$mydomain, web.$mydomain
- mynetworks = 127.0.0.0/8, 172.31.42.125, 52.43.65.253, 192.100.230.21
- smtpd_banner = host ESMTP Sendmail 2.1
- smtpd_use_tls= yes
- smtp_use_tls = yes
- tls_preempt_cipherlist = yes
- smtpd_tls_security_level = may
- smtpd_tls_auth_only = yes
- smtpd_tls_cert_file=/etc/letsencrypt/live/web.ite.lat/fullchain.pem
- smtpd_tls_key_file=/etc/letsencrypt/live/web.ite.lat/privkey.pem
- smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
- smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
- smtpd_tls_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1
- smtpd_tls_ciphers = high
- smtpd_tls_mandatory_ciphers = high
- smtp_tls_ciphers = high
- smtp_tls_mandatory_ciphers = high
- tls_high_cipherlist = ECDH+aRSA+AES256:ECDH+aRSA+AES128:AES256-SHA:AES128+EECDH:AES128+EDH
$ sudo postfix stop
$ sudo postfix start
+ To run a complete STARTTLS handshake with the MTA do: (optional)
$ openssl s_client -connect mail.ite.lat:25 -starttls smtp
+ You can enable STARTTLS log details with these settings to see which emails are
sent/received encrypted: (optional for debugging)
$ sudo /etc/postfix/main.cf
- smtp_tls_loglevel = 1
- smtpd_tls_loglevel = 1
+ To test your Postfix MTA with SMTP you can use a text user interface MUA for send/receiving email
and the following online SMTP test tools. (Alpine will be used as the MUA)
$ sudo yum install alpine
$ alpine
+ Configure Alpine with your MTA info:
- SETUP (S) -> Config (C)
- Personal Name = Meme delaTower
- User Domain = ite.lat
- SMTP Server = mail.ite.lat
+ Perform the following test on your secured MTA.
+ SMTP receiver test
- http://www.checktls.com/perl/TestReceiver.pl
+ SMTP sender test
- http://www.checktls.com/perl/TestSender.pl
Comments