Ubuntu: How to setup TLS on postfix and dovecot

[surety]

The tutorial here didn't work for me as it forces you to create a PEM passphrase, which postfix doesn't support.

The response here by americanninja worked fine for me. Sentora TLS

The link provided takes you here: PostFix TLS

this eliminated the generation of a CA cert and Key.

[angelorocha]

I have a problem, tested in http://checktls.com/perl/TestReceiver.pl


Result:




Help.

[TGates]

Nothing we can do, you are using a self-signed certificate. Get a free certificate using Let's Encrypt

You can use parts of this tutorial to get a certificate: http://forums.sentora.org/showthread.php?tid=2535

Just skip the parts for custom vhost entries and port forwarding, etc. Just make sure you have openSSL, mod_ssl and let's encrypt installed (Info in the tutorial) then update your email settings to use the new let's encrypt certificate

[DaniCV]

Followed all the steps but I got error

http://prntscr.com/gfv5g0

[zanga]

TLS works nicely after following this guide, unfortunately the forwarding stopped working.
Any idea why?

[duane]

Followed all the steps but I got error

http://prntscr.com/gfv5g0

Hi, have you found a solution to this? I have the same problem. Followed step-by-step from step3. I used letsencrypt for certificates. I'm no linux expert but what I found is dovecot is no longer running, status I'm getting is "dovecot stop/waiting" when checking the status (service dovecot status).

FYI, I created a certificate for "mydomain.com" + "mail.mydomain.com" + "panel.mydomain.com"... "mydomain.com" & "panel.mydomain.com" is working fine with ssl. Might this be the problem? Should I create a separate certificate for "mail.mydomain.com?



Ubuntu 14.04.5 | Sentora 1.0.3

[TGates]

I make separate certificates for each domain. Especially mail.domain.com because it is a different way of verifying that domain since it is not technically 'web readable'.

[duane]

I make separate certificates for each domain. Especially mail.domain.com because it is a different way of verifying that domain since it is not technically 'web readable'.

Thanks. I'll try this and get back with feedback.

[duane]

Changed /etc/dovecot/dovecot.conf line: "ssl = no to ssl = yes" to "ssl=required" and all green ticks on https://www.checktls.com