Securing your ISPConfig 3 managed mailserver with a valid Let’s Encrypt SSL certificate (certbot)

You can normally just name your server something nice in the beginning of the install but i recommend to proceed this route as works better once you start scaling your servers and add multiple email servers.

Under Sites, click “Add new website”. Set mail.example.com as domain. Disable Auto-Subdomain, and check the Let’s Encrypt checkbox.

After this you can add your other hostnames as alias domains, by going to the aliasdomain list and clicking

“Add new aliasdomain”. Select smtp.example.com as domain, and mail.example.com as parent website.

With this will be able to have clients login into gmail smtp using this domain or if they want to pay extra you can create one specific for their company domain like mail.domain.com

Disable Auto-Subdomain and save the new record
Verify that the certificate is in place. You can do this with a tool like https://www.sslshopper.com/ssl-checker.html

Replacing the certificate with the Let’s Encrypt certificate

All your doing here is using the ssl you created in ispconfig to now be used by postfix – you can also buy an ssl and paste the values in the ispconfig. ( From testing my email servers on multiple sites the ssl dont matter just as long as the handshake etc… matches so the free one works fine no need to spend money)

cd /etc/postfix/
mv smtpd.cert smtpd.cert-$(date +"%y%m%d%H%M%S").bak
mv smtpd.key smtpd.key-$(date +"%y%m%d%H%M%S").bak
ln -s /etc/letsencrypt/live/mail.example.com/fullchain.pem smtpd.cert
ln -s /etc/letsencrypt/live/mail.example.com/privkey.pem smtpd.key
systemctl restart postfix
systemctl restart dovecot

Set up a automatic renewal script

nano /etc/init.d/le_mailserver_restart.sh

Paste this in that file (replace mail.example.com with the hostname you used):

#!/bin/sh
### BEGIN INIT INFO
# Provides: LE MAILSERVER CERT AUTO UPDATER
# Required-Start: $local_fs $network
# Required-Stop: $local_fs
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: LE MAILSERVER CERT AUTO UPDATER
# Description: Restart mail server automatically when a new Let's Encrypt certificate is issued.
### END INIT INFO
systemctl restart postfix
systemctl restart dovecot

apt install incron

chmod +x /etc/init.d/le_mailserver_restart.sh
echo "root" >> /etc/incron.allow

incrontab -e

Add this (again, replace mail.example.com with the hostname you used) to the file:

/etc/letsencrypt/archive/mail.example.com/ IN_MODIFY /etc/init.d/le_mailserver_restart.sh