Docker-mailserver: Update LetsEncrypt certificates

[ghnp5]

Hello,

Just want to confirm that this is the correct procedure to update the LetsEncrypt certificates every ~3 months:

I have in my docker-compose file:

    volumes:
    - /opt/mailserver/letsencrypt:/etc/letsencrypt

I generate/renew the certificates on the host machine, then:

cp -R -L /etc/letsencrypt/live/mail.mydomain.com/* /opt/mailserver/letsencrypt/live/mail.mydomain.com/

docker exec mailserver openssl s_client -connect 0.0.0.0:25 -starttls smtp -CApath /etc/ssl/certs/
Verify return code: 0 (ok)

docker exec mailserver openssl s_client -connect 0.0.0.0:143 -starttls smtp -CApath /etc/ssl/certs/
Verify return code: 0 (ok)

Is this correct and enough? I don't need to restart any services or even the container?

Thank you very much :)

[gmasse]

I think Dovecot must be reloaded (at least):

docker-compose exec mail bash -c '[[ "$SMTP_ONLY" -ne 1 ]] && dovecot reload'

[m-a-v]

Postfix also uses the certificate, so this instance should also be reloaded:
docker exec -it mail postfix reload

[ghnp5]

Thanks guys!

[gmasse]

Postfix also uses the certificate, so this instance should also be reloaded:
docker exec -it mail postfix reload

According to my tests, postfix automatically reloads new certificate. Anyone to double check that ? In the meantime, reloading postfix would not hurt 😉

[m-a-v]

According to my tests, postfix automatically reloads new certificate. Anyone to double check that ? In the meantime, reloading postfix would not hurt 😉

Your assumption could be true. I am using SSL_TYPE=manual with dehydrated and Let's Encrypt.