Letsencrypt mail servernek

Igen, és nem kötelező a HTTP, megy pl. DNS-alapon is.

#!/bin/sh
certbot certonly -n --keep --agree-tos --manual --email postmaster@example.com \
--preferred-challenges=dns --manual-public-ip-logging-ok \
--manual-auth-hook /etc/ssl/certbot/authenticator.sh \
--manual-cleanup-hook /etc/ssl/certbot/cleanup.sh \
-d mail.example.com -d mail1.example.com

authenticator.sh:
#!/bin/sh


#CERTBOT_DOMAIN: The domain being authenticated
#CERTBOT_VALIDATION: The validation string

DIR=$(dirname $0)
DNSDIR=/var/named/external
DNSRELOAD="/etc/init.d/named.external reload"

[ -z "${CERTBOT_DOMAIN}" -o -z "${CERTBOT_VALIDATION}" ] && echo "Missing environment parameters" && exit 1

SUBDOMAIN="${CERTBOT_DOMAIN%%.*}"
DOMAIN="${CERTBOT_DOMAIN#*.}"

CERTBOTFILE="${DNSDIR}/certbot.${DOMAIN}"
SOAFILE="${DNSDIR}/soa.${DOMAIN}"

[ ! -f "${CERTBOTFILE}" ] && echo "Missing certbot file for domain ${DOMAIN}: ${CERTBOTFILE}" && exit 1
[ ! -f "${SOAFILE}" ] && echo "Missing SOA file for domain ${DOMAIN}: ${SOAFILE}" && exit 1

"$DIR/replace.pl" "${CERTBOTFILE}" "${SOAFILE}" "_acme-challenge.${SUBDOMAIN}" "${CERTBOT_VALIDATION}"

$DNSRELOAD
sleep 10

A cleanup.sh ugyanez, csak a replace.pl hivásának utolsó paramétere meg a sleep 10 kimarad.
A sleep 10 a secondary frissülése miatt van benne, nálam ennyi elég, de ehhez ugye kell a notification-alapú azonnali frissülés. A korrekt megoldás amúgy a visszaellenőrzés lenne dig segítségével.

replace.pl:
#!/usr/bin/perl -w


use strict;
use POSIX;

my $zonefile = $ARGV[0];
my $soafile = $ARGV[1];
my $label = $ARGV[2];
my $txt = $ARGV[3];

if (! defined $zonefile || $zonefile eq '' ||
! defined $soafile || $soafile eq '' ||
! defined $label || $label eq '') {
print "Usage: $0 <zone file name> <soa file name> <DNS label> [<txt value>]\n";
exit 1;
}

my $zonetempfile = $zonefile.'.tmp.'.$$;
my $soatempfile = $soafile.'.tmp.'.$$;

if (! open(ZONE, '<', $zonefile)) {
print "Error opening zone file $zonefile: $!\n";
exit 2;
}
if (! open(ZONETEMP, '>', $zonetempfile)) {
print "Error opening zone temp file $zonetempfile: $!\n";
close(ZONE);
exit 2;
}
while (<ZONE>) {
chomp;
if (/^\s*(\S+)/o) {
next if $1 eq $label;
print $1."\n";
}
print ZONETEMP $_."\n";
}
print ZONETEMP $label.' 300 IN TXT "'.$txt.'"'."\n" if defined $txt;
close(ZONETEMP);
close(ZONE);
if (! rename($zonetempfile, $zonefile)) {
print "Error renaming zone temp file $zonetempfile to $zonefile: $!\n";
exit 2;
}

my $state = 0;
if (! open(SOA, '<', $soafile)) {
print "Error opening zone file $soafile: $!\n";
exit 2;
}
if (! open(SOATEMP, '>', $soatempfile)) {
print "Error opening zone temp file $soatempfile: $!\n";
close(SOA);
exit 2;
}
while (<SOA>) {
chomp;
if ($state == 0 && /\(/o) {
$state = 1;
}
elsif ($state == 1 && /(\d+)/o) {
$state = 2;
my $serial = $1;
my $next = $serial + 1;
my $minimum = strftime('%Y%m%d01', localtime);
$next = $minimum if $next < $minimum;
s/\d+/$next/e;
}
print SOATEMP $_."\n";
}
close(SOATEMP);
close(SOA);
if (! rename($soatempfile, $soafile)) {
print "Error renaming zone temp file $soatempfile to $soafile: $!\n";
exit 2;
}

exit 0;

db.example.com:
$TTL 86400
$INCLUDE soa.example.com
...
$INCLUDE certbot.example.com

soa.example.com:
@ SOA ns.example.com. hostmaster.example.com. (
2017050520 ; serial
28800 ; refresh = 8h
14400 ; retry = 4h
5184000 ; expire = 60d
86400 ) ; minimum = 1d

manualisan is csinalhatod es akar DNS-en keresztul is :

https://www.sslforfree.com/

sub

subs