# TLS certificate for the UseSend SMTP proxy

The `usesend/smtp-proxy` image ships a default certificate that **cannot complete a
TLS 1.3 handshake** — OpenSSL rejects it with `no suitable signature algorithm`.
Because the proxy also refuses `AUTH` until `STARTTLS` has succeeded, that default
cert made *all* inbound SMTP impossible. These files replace it.

## What lives in certs/

`fullchain.pem` and `privkey.pem`, copied from NPM's Let's Encrypt store:

    ~/Server/Nginx_Proxy_Manager/volumes/letsencrypt/live/npm-43/

That certificate carries `*.usesend.gbrown.org`, which is what lets clients validate
the proxy as `smtp.usesend.gbrown.org`. A wildcard matches exactly one label, so
`*.gbrown.org` alone would not cover it.

Clients reach that name two ways, neither of them public DNS:

- containers on `nginx-bridge` get the network alias set in `compose.yml`
- LAN and home-server clients get a UniFi DNS record pointing it at `192.168.2.2`

## Why copies instead of a bind mount

NPM mounts that letsencrypt tree with `:Z`, which gives it a *private* SELinux MCS
category. A second container mounting the same path would relabel it and the two
would fight over it. Copying keeps the stacks independent.

## Keeping the copies fresh

NPM renews on its own schedule, so `usesend-cert-refresh.timer` runs
`refresh-smtp-certs` daily. It copies the cert when NPM's fingerprint changes,
refuses a half-renewed cert/key pair, and restarts the proxy.

If the copies ever expire, every app sending mail through the proxy fails at once,
with a TLS error rather than anything that mentions certificates. Check with:

    openssl x509 -in ~/Server/UseSend/certs/fullchain.pem -noout -enddate
    systemctl --user list-timers usesend-cert-refresh.timer