Tip for letsencrypt users

Hi all,

I found a convenient way to manage courier certificates by piggy-backing 
on the systemd/certbot.service.

That service runs twice a day and there are two courier related scripts 
that I need to run daily, so I combined them.

/usr/lib/courier/mkdhparams should be run daily to keep the 
/etc/courier/dhparams.pem certificate fresh.

Certbot provides 90 day certificates but renews them at 60 days.

Putting it all in /lib/systemd/system/certbot.service takes care of 
managing all of my courier related certificate duties.

In systemd service files if the [Service] section contains Type=oneshot 
it may contain multiple ExecStart= commands.  They execute sequentially.

Here's what I did to my certbot.service file:

note 1: each line begins with ExecStart=
note 2: replace DOMAIN with the domain in /etc/letsencrypt/live/
note 3: I use my-*.pem - use whatever matches your config files.

/usr/lib/courier/mkdhparams
cp -L /etc/letsencrypt/live/DOMAIN/cert.pem      /etc/courier/my-cert.pem
cp -L /etc/letsencrypt/live/DOMAIN/chain.pem     /etc/courier/my-chain.pem
cp -L /etc/letsencrypt/live/DOMAIN/fullchain.pem 
/etc/courier/my-fullchain.pem
cp -L /etc/letsencrypt/live/DOMAIN/privkey.pem   /etc/courier/my-privkey.pem
chgrp courier /etc/courier/my-*pem
chmod 640     /etc/courier/my-*pem

Hope that's useful to somebody else!


_______________________________________________
courier-users mailing list
[email protected]
Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users