40 lines
1.7 KiB
Markdown
40 lines
1.7 KiB
Markdown
# TLS certificate for the UseSend SMTP proxy
|
|
|
|
The `usesend/smtp-proxy` image ships a default certificate that **cannot complete a
|
|
TLS 1.3 handshake** — OpenSSL rejects it with `no suitable signature algorithm`.
|
|
Because the proxy also refuses `AUTH` until `STARTTLS` has succeeded, that default
|
|
cert made *all* inbound SMTP impossible. These files replace it.
|
|
|
|
## What lives in certs/
|
|
|
|
`fullchain.pem` and `privkey.pem`, copied from NPM's Let's Encrypt store:
|
|
|
|
~/Server/Nginx_Proxy_Manager/volumes/letsencrypt/live/npm-43/
|
|
|
|
That certificate carries `*.usesend.gbrown.org`, which is what lets clients validate
|
|
the proxy as `smtp.usesend.gbrown.org`. A wildcard matches exactly one label, so
|
|
`*.gbrown.org` alone would not cover it.
|
|
|
|
Clients reach that name two ways, neither of them public DNS:
|
|
|
|
- containers on `nginx-bridge` get the network alias set in `compose.yml`
|
|
- LAN and home-server clients get a UniFi DNS record pointing it at `192.168.2.2`
|
|
|
|
## Why copies instead of a bind mount
|
|
|
|
NPM mounts that letsencrypt tree with `:Z`, which gives it a *private* SELinux MCS
|
|
category. A second container mounting the same path would relabel it and the two
|
|
would fight over it. Copying keeps the stacks independent.
|
|
|
|
## Keeping the copies fresh
|
|
|
|
NPM renews on its own schedule, so `usesend-cert-refresh.timer` runs
|
|
`refresh-smtp-certs` daily. It copies the cert when NPM's fingerprint changes,
|
|
refuses a half-renewed cert/key pair, and restarts the proxy.
|
|
|
|
If the copies ever expire, every app sending mail through the proxy fails at once,
|
|
with a TLS error rather than anything that mentions certificates. Check with:
|
|
|
|
openssl x509 -in ~/Server/UseSend/certs/fullchain.pem -noout -enddate
|
|
systemctl --user list-timers usesend-cert-refresh.timer
|