Secure Socket Layer (SSL) tidak hanya digunakan untuk secure untuk website saja, mail server juga perlu SSL tentunya sebagai koneksi antara client dan server dapat berjalan secara aman dari pihak lain, dengan SSL maka komunikasi client dengan server mail kita lebih secure atau kata lainnya terenkripsi.
iRedMail sebagai mail server secara default pada saat instalasi sudah terinstall SSL self sign dan jika Anda ingin menggunakan SSL berbayar misal menggunakan SSL nya Globalsign atau menggunakan SSL Free dari Letsencrypt dapat di lakukan.
Disini kami akan mencontohkan bagaimana cara install SSL Letsencrypt di iRedMail mulai dari mengamankan web admin iRedMail sampai memasang SSL di postfix dan dovecot iRedMail.
Untuk mengikuti tutorial kali ini pastikan Anda sudah mengikuti tutorial berikut ya: Membuat Mail Server Menggunakan iRedMail di CentOS 8
Untuk melakukan instalasi Letsencrypt jalankan perintah berikut:
1
2
[root@mail ~]#
[root@mail ~]# dnf install certbot python3-certbot-nginx -y
Selanjutnya generate SSL Letsencrypt menggunakan perintah berikut
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
[root@mail ~]#
[root@mail ~]# certbot certonly --webroot --agree-tos --email postmaster@nurhamim.my.id -d mail.nurhamim.my.id -w /var/www/html/
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Yes
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for mail.nurhamim.my.id
Using the webroot path /var/www/html for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Subscribe to the EFF mailing list (email: postmaster@nurhamim.my.id).
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/mail.nurhamim.my.id/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/mail.nurhamim.my.id/privkey.pem
Your cert will expire on 2020-12-07. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- Your account credentials have been saved in your Certbot
configuration directory at /etc/letsencrypt. You should make a
secure backup of this folder now. This configuration directory will
also contain certificates and private keys obtained by Certbot so
making regular backups of this folder is ideal.
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
- We were unable to subscribe you the EFF mailing list because your
e-mail address appears to be invalid. You can try again later by
visiting https://act.eff.org.
[root@mail ~]#
Noted: Silakan sesuaikan dengan host atau name mail server Anda disini mail server kami yaitu mail.nurhamim.my.id.
Saat ini kita sudah mempunyai SSL Letsencrypt. Ada 3 Bagian yang akan kita pasangkan SSL diantaranya:
– Pasang SSL Untuk Administrator, Webmail iRedMail
Untuk memasang SSL Administratori, Webmail dari iRedMail Anda hanya perlu mengubah atau menyesuaikannya pada direktori /etc/nginx/templates/ssl.tmpl berikut:
1
2
[root@mail ~]#
[root@mail ~]# vim /etc/nginx/templates/ssl.tmpl
Default konfigurasi SSL nya seperti berikut
1
2
3
4
# To request free "Let's Encrypt" cert, please check our tutorial:
# https://docs.iredmail.org/letsencrypt.html
ssl_certificate /etc/pki/tls/certs/iRedMail.crt;
ssl_certificate_key /etc/pki/tls/private/iRedMail.key;
Ubah menjadi seperti berikut
1
2
3
4
# To request free "Let's Encrypt" cert, please check our tutorial:
# https://docs.iredmail.org/letsencrypt.html
ssl_certificate /etc/letsencrypt/live/mail.nurhamim.my.id/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mail.nurhamim.my.id/privkey.pem;
Simpan konfigurasi diatas dan verifikasi konfigurasi web server nginx, pastikan tidak ada yang salah konfigurasi
1
2
3
4
5
[root@mail ~]#
[root@mail ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@mail ~]#
Selanjutnya reload Nginx
1
2
[root@mail ~]# systemctl reload nginx
[root@mail ~]#
Silakan maksure atau pastikan SSL sudah terinstall dengan cara akses Administrator iRedMail, pastikan sudah HTTPS contohnya
- Administrator
- Webmail
– Pasang SSL Untuk Postfix
Untuk memasang SSL di Postfix sangatlah mudah, silakan buka file konfigurasi postfix di iRedMail
1
2
[root@mail ~]#
[root@mail ~]# vim /etc/postfix/main.cf
Default konfigurasi SSL nya seperti berikut
1
2
3
4
5
6
7
8
9
#
# TLS settings.
#
# SSL key, certificate, CA
#
smtpd_tls_key_file = /etc/pki/tls/private/iRedMail.key
smtpd_tls_cert_file = /etc/pki/tls/certs/iRedMail.crt
smtpd_tls_CAfile = /etc/pki/tls/certs/iRedMail.crt
smtpd_tls_CApath = /etc/pki/tls/certs
Silakan ubah menjadi seperti berikut
1
2
3
4
5
6
7
8
9
#
# TLS settings.
#
# SSL key, certificate, CA
#
smtpd_tls_key_file = /etc/letsencrypt/live/mail.nurhamim.my.id/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.nurhamim.my.id/cert.pem
smtpd_tls_CAfile = /etc/letsencrypt/live/mail.nurhamim.my.id/chain.pem
smtpd_tls_CApath = /etc/pki/tls/certs
Simpan konfigurasi diatas dan silakan reload postfix menggunakan perintah berikut
1
2
[root@mail ~]# systemctl reload postfix
[root@mail ~]#
– Pasang SSL Untuk Dovecot
Sama seperti postfix di dovecot juga sangat mudah untuk memasang SSL nya silakan buka konfigurasi dovecot berikut
1
2
[root@mail ~]#
[root@mail ~]# vim /etc/dovecot/dovecot.conf
Default konfigurasi SSL di dovecot
1
2
3
4
#ssl_ca = </path/to/ca
ssl_cert = </etc/pki/tls/certs/iRedMail.crt
ssl_key = </etc/pki/tls/private/iRedMail.key
ssl_dh = </etc/pki/tls/dh2048_param.pem
Silakan ubah menjadi seperti berikut
1
2
3
4
#ssl_ca = </path/to/ca
ssl_cert = </etc/letsencrypt/live/mail.nurhamim.my.id/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.nurhamim.my.id/privkey.pem
ssl_dh = </etc/pki/tls/dh2048_param.pem
Silakan simpan konfigurasi diatas dan reload dovecot
1
2
[root@mail ~]# systemctl reload dovecot
[root@mail ~]#
Oke, saat ini SSL sudah terpasang dengan sempurna.
Selamat mencoba 😁