letsencrypt certs

Hi Michael,

After installing the first certificate, macOS Server requires a bit of work every 90 days. Should be no more than 5 minutes per server every 3 months, which is acceptable. Nice way to look how the server is doing 🙂

You can use the contents of this script below to prepare for renewal and importing the new certificate into the Server.app. Then you would need to select the new certificate in the server.app per service. And remove the old certificate. Adapt this script, name it renew.sh or something and use chmod +x to make it executable:

#!/bin/sh

DOMAIN="your.domain.here"

PEM_FOLDER="/etc/letsencrypt/live/${DOMAIN}/"

# Renew the certificate

sudo certbot renew --quiet

# Generate a passphrase

PASS=$(openssl rand -base64 45 | tr -d /=+ | cut -c -30)

# Transform the pem files into a p12 file

sudo openssl pkcs12 -export -inkey "${PEM_FOLDER}privkey.pem" -in "${PEM_FOLDER}cert.pem" -certfile "${PEM_FOLDER}fullchain.pem" -out "${PEM_FOLDER}letsencrypt_sslcert.p12" -passout pass:$PASS

# Import the p12 file into the keychain

sudo security import "${PEM_FOLDER}letsencrypt_sslcert.p12" -f pkcs12 -k /Library/Keychains/System.keychain -P $PASS -T /Applications/Server.app/Contents/ServerRoot/System/Library/CoreServices/Server ManagerDaemon.bundle/Contents/MacOS/servermgrd

Goodluck!

Jeffrey

Hi,

Just follow the instructions provided by letsencrypt:

https://letsencrypt.org/getting-started/

you will need certbot:

https://certbot.eff.org/lets-encrypt/osx-apache

which requires homebrew:

https://brew.sh/

so in other words, install homebrew first, follow the instructions then install certbot.

You will need an A record pointing towards your server and have port 80 and 443 open to your webserver.

Depending on your setup this command might help you setup things, but the basic commands of certbot should take you all the way.

certbot certonly --webroot -w /Library/Server/Web/Data/Sites/Default/ -d name.ofyourdomain.com

If your webroot is on another volume, change the full path.

Goodluck

Jeffrey

Support for LetsEncrypt ACME support is now part of Apache.

Any package with a current Apache should or soon will have mod_md available, too.

We're headed for changes with macOS Server, and the Apache web server is among what's being deprecated. Apple has available a service migration guide document with added details.

In aggregate, this leads to either configuring and loading Apache 2.4.30 or later yourself, or manually building and loading the LetsEncrypt ACME mod_md module into your existing macOS Server.app Apache installation. Or migrating away from macOS for servers, or migrating to some other add-on web server for macOS such as MAMP, of course. Hopefully the built-in Apache web server stays (more) current, and with a full set of modules...

Most any of which will leave you with support for LetsEncrypt certificates and automatic renewals.

Low-cost certs are around $10 to $15 per year, or — if the mail server is your own local activity, and without other "random" mail clients outside your control, and with comparatively little mail exchanged with other mail servers across the 'net — then you can generate a self-signed cert-pair yourself and use that

I'm in the midst of sorting out a similar issue on a not-very-public mail server, and have found the certificate assistant tool is probably best avoided in favor of using the command line to generate the self-signed certs.

Hi,

Glad to see you got it working! This was the hardest part, but that little command line helps. Otherwise you would need to edit the webfolder and it’s permissions.

Renewing is even easier and Apple does have plans to stop webservices this autumn, but you should be ok for at least a year or so for now. Your needs might change during that time, but for now your mailtraffic is secure.

Have a Nice day.

Jeffrey