Configure Lets Encrypt Cert in Postfix in a RHEL7 server
============================================================================================

1. Install Apache Web Server
--------------------------------------

$ sudo yum groupinstall -y "Web Server"
$ sudo vim /etc/hosts
	- add: 1.2.3.4 host.example.com example.com
$ sudo vim /etc/hostname
	- add: host.example.com
$ sudo vim /etc/httpd/conf/httpd.conf
	- set the ServerName directive in the /etc/httpd/conf/httpd.conf file
$ sudo vim /etc/httpd/conf.d/ssl.conf
	- set the ServerName directive in the /etc/httpd/conf.d/ssl.conf file
$ sudo hostname -f /etc/hostname
$ sudo systemctl enable httpd
$ sudo systemctl start httpd

+ Open port 80 and 443 in AWS firewall rules in your AWS/EC2 instance console

+ Make sure you have installed the latest version of OpenSSL in your server.
$ sudo yum update openssl

+ Tune Apache 2.4 TLS configuration
$ sudo vim /etc/httpd/conf.d/ssl.conf
	- SSLProtocol TLSv1.2
	- SSLHonorCipherOrder On
	- SSLCipherSuite "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES128:RSA+AESGCM!aNULL:!MD5:!DSS:!LOW:!MEDIUM"
	- Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
	- Header always set X-Frame-Options DENY
	- Header always set X-Content-Type-Options nosniff
	# Requires Apache >= 2.4
	- SSLCompression off
$ sudo apachectl restart

2. Install Lets Encrypt CA - CertBot
--------------------------------------

$ sudo yum-config-manager --enable rhui-REGION-rhel-server-extras
$ sudo yum-config-manager --enable rhui-REGION-rhel-server-optional
$ sudo yum repolist all
$ wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
$ sudo rpm -Uvh epel-release-latest-7*.rpm
$ sudo yum install python-certbot-apache
$ sudo certbot --apache

+ Your certificate and chain have been saved at /etc/letsencrypt/live/<domain>
+ Lets encrypt certificates expire 90 days after they were issue.
+ To obtain a new or tweaked version of this certificate in the future, 
    simply run certbot again with => certbot --apache certonly
+ To non-interactively renew *all* of your certificates, 
	run with => certbot renew --dry-run 
+ If that appears to be working correctly, you can arrange for automatic renewal
	by adding a cron or systemd job which runs the 
	following => certbot renew --quiet

3. Install Postfix

$ sudo yum install postfix
$ sudo /etc/postfix/main.cf
	- myhostname = host2.ite.lat
	- mydomain = ite.lat
	- myorigin = $mydomain
	- inet_interfaces = $myhostname, localhost
	- mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
                      mail.$mydomain, web.$mydomain
	- mynetworks = 127.0.0.0/8, 172.31.42.125, 52.43.65.253, 192.100.230.21
	- smtpd_banner = host ESMTP Sendmail 2.1
	- smtpd_use_tls= yes
	- smtp_use_tls = yes
    - tls_preempt_cipherlist = yes
	- smtpd_tls_security_level = may
	- smtpd_tls_auth_only = yes
	- smtpd_tls_cert_file=/etc/letsencrypt/live/web.ite.lat/fullchain.pem
	- smtpd_tls_key_file=/etc/letsencrypt/live/web.ite.lat/privkey.pem
	- smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
	- smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
	- smtpd_tls_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1
	- smtpd_tls_ciphers = high
	- smtpd_tls_mandatory_ciphers = high
	- smtp_tls_ciphers = high
	- smtp_tls_mandatory_ciphers = high
    - tls_high_cipherlist = ECDH+aRSA+AES256:ECDH+aRSA+AES128:AES256-SHA:AES128+EECDH:AES128+EDH

 $ sudo postfix stop
 $ sudo postfix start

+ To run a complete STARTTLS handshake with the MTA do: (optional)

$ openssl s_client -connect mail.ite.lat:25 -starttls smtp

+ You can enable STARTTLS log details with these settings to see which emails are 
	sent/received encrypted: (optional for debugging)

$ sudo /etc/postfix/main.cf
	- smtp_tls_loglevel = 1
	- smtpd_tls_loglevel = 1

+ To test your Postfix MTA with SMTP you can use a text user interface MUA for send/receiving email
  and the following online SMTP test tools. (Alpine will be used as the MUA)

$ sudo yum install alpine
$ alpine

	+ Configure Alpine with your MTA info:
	- SETUP (S) -> Config (C)
		- Personal Name			=	Meme delaTower
		- User Domain			=	ite.lat
		- SMTP Server			= 	mail.ite.lat

+ Perform the following test on your secured MTA.

	+ SMTP receiver test
		- http://www.checktls.com/perl/TestReceiver.pl
	+ SMTP sender test
    	- http://www.checktls.com/perl/TestSender.pl