1.7 KiB
TLS certificate for the UseSend SMTP proxy
The usesend/smtp-proxy image ships a default certificate that cannot complete a
TLS 1.3 handshake — OpenSSL rejects it with no suitable signature algorithm.
Because the proxy also refuses AUTH until STARTTLS has succeeded, that default
cert made all inbound SMTP impossible. These files replace it.
What lives in certs/
fullchain.pem and privkey.pem, copied from NPM's Let's Encrypt store:
~/Server/Nginx_Proxy_Manager/volumes/letsencrypt/live/npm-43/
That certificate carries *.usesend.gbrown.org, which is what lets clients validate
the proxy as smtp.usesend.gbrown.org. A wildcard matches exactly one label, so
*.gbrown.org alone would not cover it.
Clients reach that name two ways, neither of them public DNS:
- containers on
nginx-bridgeget the network alias set incompose.yml - LAN and home-server clients get a UniFi DNS record pointing it at
192.168.2.2
Why copies instead of a bind mount
NPM mounts that letsencrypt tree with :Z, which gives it a private SELinux MCS
category. A second container mounting the same path would relabel it and the two
would fight over it. Copying keeps the stacks independent.
Keeping the copies fresh
NPM renews on its own schedule, so usesend-cert-refresh.timer runs
refresh-smtp-certs daily. It copies the cert when NPM's fingerprint changes,
refuses a half-renewed cert/key pair, and restarts the proxy.
If the copies ever expire, every app sending mail through the proxy fails at once, with a TLS error rather than anything that mentions certificates. Check with:
openssl x509 -in ~/Server/UseSend/certs/fullchain.pem -noout -enddate
systemctl --user list-timers usesend-cert-refresh.timer