Apacheが動いているAlmaLinux8でPostfix用のLet’sEncryptの証明書を取得する

AlmaLinux release 8.5 (Arctic Sphynx)
certbot 1.22.0
apache 2.4.37
postfix 3.5.8

Let’sEncryptの証明書を発行するためのcertbotをインストールする。

# dnf install epel-release
# dnf install certbot

ACMEプロトコル用にApacheの設定を行う。

Alias /.well-known/acme-challenge/ "/var/lib/letsencrypt/.well-known/acme-challenge/"
<Directory "/var/lib/letsencrypt/">
    AllowOverride None
    Options IncludesNoExec
    Require method GET
</Directory>

Apacheの設定を再読み込みする。

# systemctl reload httpd

SSL証明書を発行する。何度も失敗したりしても制限がかかるので、–dry-runオプションを指定してテストする。

# certbot certonly --webroot -w /var/lib/letsencrypt/ -d test.example.com
-------------------------------------------------------------
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): admin@test.example.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.
Requesting a certificate for test.example.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/test.example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/test.example.com/privkey.pem
This certificate expires on 2022-08-01.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

発行が成功すると下記の場所に証明書が作られる。ほかのサーバーに移行する場合は/etc/letsencrypt/ごとコピーすればOKだった。

/etc/letsencrypt/live/test.example.com/cert.pem
/etc/letsencrypt/live/test.example.com/privkey.pem
/etc/letsencrypt/live/test.example.com/chain.pem
/etc/letsencrypt/live/test.example.com/fullchain.pem

cronで毎朝4時にSSL証明書を更新するジョブを追加する。更新されるかは自動で決定され、更新された場合のみ–deploy-hookオプションで指定されたコマンドが実行される。

0 4 * * * certbot renew --deploy-hook "systemctl reload postfix"

Postfixのmain.cfを編集して証明書の設定をする。
※変更箇所のみ記載

# Certificate settings.
smtpd_tls_cert_file = /etc/letsencrypt/live/test.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/test.example.com/privkey.pem