Extract ACME certificates from Stalwart and store as files

[h3ndrk]

Hi,

I'm using Stalwart as ACME certificate retriever. I would like to use the certificates for another service.

1. Is there a way to extract the certificates and also, e.g., run a script to restart the other service?
2. Or should I use another ACME certificate retriever like certbot and configure Stalwart and my other service to use these certificates instead?

Thanks in advance!

[h3ndrk]

I deployed certbot now which provides ACME certificates. But let's keep this thread open for answers for others.

If you want to clone my setup, here are my steps:

1. I installed certbot via https://certbot.eff.org/instructions?ws=other&os=pip
2. Disable ACME provider in Stalwart
3. Get certbot working with DNS challenge, in my case installing a DNS provider plugin and configuring it properly
4. Certificates and private keys deployed via certbot are only readable by root due to security reasons. Therefore, I added a group certificates and added stalwart-mail to it via usermod -aG certificates stalwart-mail.
5. Add the following hooks to /etc/letsencrypt/renewal-hooks/deploy:
   • 0-fix-permissions.sh to allow users (Stalwart) in certificates group to access the certificates and private keys

     #!/bin/bash
     
     set -ex
     
     chgrp --recursive certificates /etc/letsencrypt/archive /etc/letsencrypt/live
     chmod --recursive g+rx /etc/letsencrypt/archive /etc/letsencrypt/live
     

   • 1-reload-stalwart.sh, enter your proper credentials

     #!/bin/bash
     
     set -e
     
     export URL=https://127.0.0.1
     export CREDENTIALS=...
     
     set -x
     
     /opt/stalwart-mail/bin/stalwart-cli server reload-certificates
     

• Add the following lines to your config.toml (replace ... with your proper domain):

  certificate.default.cert = "%{file:/etc/letsencrypt/live/.../fullchain.pem}%"
  certificate.default.default = true
  certificate.default.private-key = "%{file:/etc/letsencrypt/live/.../privkey.pem}%"
  certificate.default.subjects = "..."
  

• Restart Stalwart to make it aware of the changed ACME settings etc.
• Setup automatic certbot renewal
• ...
• Profit

[mdecimus]

Hi,

Is there a way to extract the certificates and also, e.g., run a script to restart the other service?

Not currently.

Or should I use another ACME certificate retriever like certbot and configure Stalwart and my other service to use these certificates instead?

You could use Caddy for instance.

[h3ndrk]

Thanks!