How to map Traefik2 generated LE certificates to Poste.io mail server? reddit / selfhosted ---------------------------------------------------------------------- producemyfrench · 2023-10-16 11:46 Hello everyone here, I've been reading more than posting and am eternally grateful for posts and resources compiled in here, so THANK YOU everyone already :) To my specific issue. I've had a small VPS hosting only the mailserver [poste.io](https://poste.io) via docker-compose, that worked well and certificates for multiple domains were taken care of via poste's internal let'sencrypt support. Then I moved the mailserver to my big VPS where I also run traefik as reverse proxy. I figured out the labels, everything fine so far. But poste was using the old certificate files and they just expired. Now I'd like to just have traefik deal with them, but am unsure on how and where to pass the certificates from acme.json to poste for poste to understand. [Poste.io](https://Poste.io) uses Dovecot, NGiNX, Haraka. **How can I use my traefik certificates from the letsencrypt/acme.json of that container?** **Do I need to export the keys / certificates?** **Which ones are necessary and where, so that all my email domains have a working certificate?** ​ [Here](https://poste.io/doc/mailserver-parts) is the [poste.io](https://poste.io) documentation. I'd be super grateful for any pointers! Tried to ask google and GPT, but I think I'm missing some understanding that prevents me asking the right question even... ​ Poste's has a folder `ssl` that contains these files: README.md ca.crt dh4096.pem server.crt server.key and a folder `letsencrypt` . The readme reads as follows: README.md This directory is supposed to have 3 keys which are copied to various places to mailserver. - ca.crt Certification authority public keys (or "intermediate certificate"). There is "-----BEGIN CERTIFICATE-----" once or more times. - server.crt Your public key generated by your CA. It should have one "----- BEGIN CERTIFICATE-----" in it - server.key Your private key, it should have "-----BEGIN RSA PRIVATE KEY-----" in it There is also - dh1024.pem Its generated Diffie-Hellman paramaters. File is generated once at first container startup - there is no need to manipulate with that file even if you changing all certs. Letsencrypt folder structure: letsencrypt - _account - private.pem - public.pem - mail.mydomain.com - cert.pem - chain.pem - fullchain.pem - last.csr - private.pem - public.pem ​ ​ MAIL DOCKER COMPOSE version: "3" services: mail: image: analogic/poste.io container_name: mail hostname: ${MAIL_SERVER_HOSTNAME} restart: always # extra_hosts: # - "host.docker.internal:host-gateway" environment: - TZ=Europe/Berlin - HTTPS=OFF #- HTTP_PORT=5080 #- HTTPS_PORT=5443 # - LETSENCRYPT_HOST=${MAIL_SERVER_HOSTNAME} # - VIRTUAL_HOST=${MAIL_SERVER_HOSTNAME} ports: - '25:25' # SMTPS - mostly processing incoming mails - '465:465' # SMTPS - mostly processing incoming mails #- '80:80' # HTTP - redirect to https (see options) and authentication for Let's encrypt service - '110:110' # POP3 - standard protocol for accessing mailbox, STARTTLS is required before client auth - '143:143' # IMAP - standard protocol for accessing mailbox, STARTTLS is required before client auth #- '443:443' # HTTPS - access to administration or webmail client - '587:587' # MSA - SMTP port used primarily for email clients after STARTTLS and auth - '993:993' # IMAPS - alternative port for IMAP encrypted since connection - '995:995' # POP3S - encrypted POP3 since connections volumes: - "./data:/data" labels: - "traefik.enable=true" - "traefik.http.routers.mail.rule=${MAIL_SERVER_HOSTNAME_RULE}" - "traefik.http.routers.mail.entrypoints=secure" - "traefik.http.routers.mail.tls.certresolver=le" - "traefik.http.services.mail.loadbalancer.server.port=80" networks: - traefik networks: traefik: external: true ​ TRAEFIK DOCKER COMPOSE version: '3' services: traefik: image: "traefik" container_name: traefik ports: - "80:80" - "443:443" volumes: - /var/run/docker.sock:/var/run/docker.sock - ./traefik.yml:/etc/traefik/traefik.yaml:ro - ./usersFile:/etc/traefik/usersFile - ./letsencrypt:/letsencrypt labels: - "traefik.enable=true" # HTTP to HTTPS redirection - "traefik.http.routers.http_catchall.rule=HostRegexp(`{any:.+}`)" - "traefik.http.routers.http_catchall.entrypoints=insecure" - "traefik.http.routers.http_catchall.middlewares=https_redirect" - "traefik.http.middlewares.https_redirect.redirectscheme.scheme=https" - "traefik.http.middlewares.https_redirect.redirectscheme.pe rmanent=true" # Docker labels for enabling Traefik dashboard - "traefik.http.routers.traefik.rule=Host(`${DASHBOARD_DOMAIN}`)" - "traefik.http.routers.traefik.entrypoints=secure" - "traefik.http.routers.traefik.service=api@internal" - "traefik.http.routers.traefik.tls.certresolver=le" - "traefik.http.middlewares.admin.basicauth.usersfile=/etc/t raefik/usersFile" - "traefik.http.routers.traefik.middlewares=admin" restart: always networks: default: external: name: "traefik" ​ TRAEFIK.YML CONFIG #Define HTTP and HTTPS entrypoints entryPoints: insecure: address: ":80" secure: address: ":443" #Dynamic configuration will come from docker labels providers: docker: endpoint: "unix:///var/run/docker.sock" network: "traefik" exposedByDefault: false api: insecure: true dashboard: true #Enable acme with http file challenge certificatesResolvers: le: acme: email: email@mydomain.com storage: /letsencrypt/acme.json # caServer: https://acme- staging-v02.api.letsencrypt.org/directory caServer: https://acme-v02.api.letsencrypt.org/directory httpChallenge: # used during the challenge entryPoint: insecure ​ ---------------------------------------------------------------------- thekrautboy · 2023-10-16 12:10 Why do you want to do this? It doesnt make a whole lot of sense to me. Traefik stores its LE data in acme.json but the cert and key are not there in a common format, you would need to figure out a way to "convert" them i guess. And i dont think the Traefik devs have accounted for such a odd use case. Dig deeper into the Traefik docs or simply ask the devs through the Traefik Github if this is possible and how. /r/Traefik also exists. It would be much simpler and logical to generate separate certs just for your mail server, for example with [certbot](https://certbot.eff.org/) or even simpler with the [lego](https://github.com/go-acme/lego) tool. Can easily be scheduled with a cronjob to automatically renew. ---------------------------------------------------------------------- producemyfrench · 2023-10-16 12:36 I guess I wanted to do that so I wouldn't need to change my configs a whole lot, as I'm not super confident in my understanding of it all. Traefik is generating the right certificates for my domains, so if I can just make Poste use those that'd be easiest I thought. With lego I'd be unsure on how to do it parallel to my traefik setup and I guess generally I'm struggling to understand which parts do what and how I can best solve it... But thanks for your pointers! ---------------------------------------------------------------------- thekrautboy · 2023-10-16 12:49 > With lego I'd be unsure on how to do it parallel to my traefik setup They are completely independent of each other. Lego is very easy to use and it just writes the cert and key as files, then you do whatever you want with those. > I guess generally I'm struggling to understand which parts do what and how I can best solve it... We all have to start to learn somewhere. Maybe try /r/LinuxQuestions and /r/HomeNetworking too for example. /r/LetsEncrypt is also a thing. ---------------------------------------------------------------------- producemyfrench · 2023-10-16 14:57 Thanks, will keep reading and trying things! ---------------------------------------------------------------------- Electronic_Title_370 · 2023-10-16 17:35 I've done the same on my VPS. The only difference is that i used docker-mailserver not [poste.io](https://poste.io). I used the cert-dumper container from [https://github.com/kereis/traefik-certs- dumper](https://github.com/kereis/traefik-certs-dumper). It parses the acme.json and exports the certificate to a folder.