letsencrypt certificate expired - how do i generate and configure a new for modoboa

[CyberfoxDK]

Very simple question, but not so simple a solution.

My certificate expired... how do i create and assign a new certificate (letsencrypt or other) to modoboa ?

[tonioo]

Your certificate should be renewed automatically, there is a dedicated cron job for that

[nicosqc]

I just checked my nginx files and if you restrict access to port 80, autoconfig will not work:
/etc/nginx/sites-enabled/autoconfig.myserver.tld.conf

# This file was automatically installed on 2022-06-20T12:08:51.089851
upstream automx {
    server unix:/run/uwsgi/app/automx_instance/socket fail_timeout=0;
}

server {
    listen 80;
    listen [::]:80;
    server_name autoconfig.myserver.tld;
    root /srv/automx/instance;

    access_log /var/log/nginx/autoconfig.myserver.tld-access.log;
    error_log /var/log/nginx/autoconfig.myserver.tld-error.log;

    location /mail/config-v1.1.xml {
        include uwsgi_params;
        uwsgi_pass automx;
    }
}

You can see that the autoconfig utility is listening on Port 80, which will no longer work if you completely block access to this port.

[CyberfoxDK]

I would not do so on the webserver itself, but on a dedicated firewall.
The most important thing for me, is that i will be able to renew the certificate even if it expires. I did not believe that was a possibility earlier, so it makes things much more simple.

If i were to do it on the server itself, i would probably create some iptable or netfilter firewall rule to block access to port 80, instead of messing with the code config (i am not a programmer) which i have limited knowledge about.
This could also be done as part of the cronjob, and disable the firewall rule blocking port 80, before the renewel attempt was executed.
Once the renewal was done of failed, the firewall rule could be activated again.

[nicosqc]

If you do not allow access of Port 80 through the firewall you will have issues using the automatic mail configuration features most mail clients provide, so your users will have to manually type in the IMAP- and SMTP-server details, as well as knowing the port for your mail server. A mail client will look in the preconfigured destinations using HTTP and Port 80 and since this is on the client side this will inevitably break.

Autoconfiguration Utility automx2

You can see for yourself when using Outlook on Windows; open Outlook and then in the task bar right click on the Outlook symbol while holding down the CTRL-key. Select Test E-mail AutoConfiguration with and without the firewall rule in place and check if it makes a difference. Maybe I am wrong and it works regardless, the Nginx configuration does suggest otherwise.

[CyberfoxDK]

You are absolutely correct, port 80 is needed for autocorrect.
(Worked as an Exchange architech some years ago)
But in my case, this is blocked on the perimeter firewall.
Your point though, makes my suggestion to use iptable on the host to deny access to port 80 obsolete... if you need autoconfig, you would need port 80 to be accessible.

[nicosqc]

If you have to manually open port 80 in an external firewall to do a renew of the certificate but you are able to automatically add or remove DNS records instead, you could have a look at the certbot docs for the --manual option here and use the --preferred-challenges dns in a set of scripts or tweak the firewall to allow https://acme-v02.api.letsencrypt.org/directory as this is the default server that challenges are performed against (which you have already done from my understanding).