Custom SSL Certificates for the Panel, Webmail and the Mail Service

HiTechCloud issues Let's Encrypt certificates for its own hostname automatically. This article is for the case where you want to use a certificate you bought (or one issued elsewhere) for one or more of:

• the panel and admin interfaces (https://srv.example.com:2083 / :2087)
• the webmail (https://webmail.example.com)
• the mail service itself - what Postfix and Dovecot present on 465/587/993/995, which can be a different hostname and certificate from the panel's (mail.example.com)

Certificates are per hostname, so each of the three can use its own.

Services on the host (3.x and later)​

Panel and admin (HiTechCloud + HiTechAdmin)​

From the interface: HiTechAdmin > Settings > General > Panel domain SSL shows the certificate currently served for the hostname set above it, with Issue / renew Let's Encrypt and Install custom certificate (paste the certificate with its chain and the private key; they are checked as a pair and the panels restart to pick it up).

From the terminal:

hitechcloudcli ssl upload srv.example.com --cert /root/srv.crt --key /root/srv.key [--chain /root/ca.crt]
systemctl restart hitechcloud hitechadmin

Certificates live in /etc/hitechcloud/native/ssl/<hostname>/fullchain.pem and privkey.pem.

Webmail​

The webmail is a front-end vhost on the same 80/443 the websites use. Give it a hostname and a certificate:

hitechcloudcli webmail domain add webmail webmail.example.com
# own certificate instead of Let's Encrypt:
hitechcloudcli ssl upload webmail.example.com --cert /root/webmail.crt --key /root/webmail.key
hitechcloudcli webmail configure

ssl upload installs the certificate and reloads the front-end; a later ssl issue webmail.example.com replaces it with a Let's Encrypt one if you ever want to go back.

Mail service (Postfix / Dovecot) - a separate hostname and certificate​

By default the mail services present the panel hostname's certificate. To give mail a name of its own:

# 1. the name mail answers under (HELO, IMAP/SMTP TLS, autoconfig)
hitechcloudcli mail hostname mail.example.com

# 2. its certificate - your own ...
hitechcloudcli ssl upload mail.example.com --cert /root/mail.crt --key /root/mail.key
# ... or Let's Encrypt (the name must resolve to this server)
hitechcloudcli ssl issue mail.example.com --no-wildcard

# 3. point Postfix/Dovecot at it (also run automatically after every issue/renewal/upload)
hitechcloudcli mail tls

Check the result:

hitechcloudcli mail identity      # HELO name vs certificate vs reverse DNS
hitechcloudcli mail test          # 25/465/587/993 answer with the new certificate
openssl s_client -connect mail.example.com:993 -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

To go back to the panel's hostname and certificate: hitechcloudcli mail hostname --panel.

Websites (end users)​

End-users add their own certificates from HiTechCloud > Domains > SSL, and administrators can paste a certificate/key for any domain on HiTechAdmin > Domains > Manage SSL. See Custom SSL for Domains.

Container stack (2.x)​

On the container stack Caddy terminates TLS for the panel and the webmail, and the mail container reads certificate paths from its environment.

• Let's Encrypt certificates are stored in /etc/hitechcloud/caddy/ssl/acme-v02.api.letsencrypt.org-directory/
• Custom certificates go in /etc/hitechcloud/caddy/ssl/custom/<hostname>/<hostname>.crt and <hostname>.key

Panel and admin​

mkdir -p /etc/hitechcloud/caddy/ssl/custom/srv.example.com/
# upload srv.example.com.crt and srv.example.com.key there, then
hitechcloudcli domain set srv.example.com

hitechcloudcli domain set prefers a custom pair for the hostname when one is present; if you edited the Caddyfile by hand, add under the hostname's block:

tls /etc/hitechcloud/caddy/ssl/custom/srv.example.com/srv.example.com.crt /etc/hitechcloud/caddy/ssl/custom/srv.example.com/srv.example.com.key

and docker restart caddy.

Webmail​

mkdir -p /etc/hitechcloud/caddy/ssl/custom/webmail.example.com/
# upload webmail.example.com.crt / .key, then
hitechcloudcli email-webmail domain webmail.example.com

If the Caddyfile's # START WEBMAIL DOMAIN # block has no tls line, add one as above and restart Caddy.

Mail service​

The mail container takes SSL_TYPE=manual with SSL_CERT_PATH / SSL_KEY_PATH in /etc/hitechcloud/mailserver/mailserver.env. hitechcloudcli domain set writes them for the panel hostname; for a separate mail hostname set them yourself:

SSL_TYPE=manual
SSL_CERT_PATH=/etc/hitechcloud/caddy/ssl/custom/mail.example.com/mail.example.com.crt
SSL_KEY_PATH=/etc/hitechcloud/caddy/ssl/custom/mail.example.com/mail.example.com.key

then cd /root && docker --context default compose up -d hitechadmin_mailserver.