Postfix not updating Let's Encrypt certificate

Question

Whenever I update the SSL cert on the server (Alma Linux) I restart Postfix. I usually do this a few days or a week before the certificate runs out. However mail connections always fail on the day the old certificate expires, at that point I have to restart Postfix a second time.

This happens every time and I have had to do this on at least 5 occasions. Every time simply restarting Postfix solves the problem. The reference to the cert in Postfix is to the Let's encrypt folder and nothing else is done to the Postfix config when renewing the certificate. Below is the config in main.cf:

#SSL

smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtp_tls_security_level = may
smtpd_tls_security_level = may

smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.net/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.net/privkey.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

So how can I get Postfix to adopt the new certificate when I install it? Otherwise I have to wait until the e-mail goes down and do a restart, leading to downtime for clients.

Answer 1

The Certbot always updates the symbolic links in /etc/letsencrypt/live/ to the latest files in /etc/letsencrypt/archive/ when it renews a Let's Encrypt certificate, so this should not happen if Postfix is either reloaded or restarted after the renewal.

However, the reload should also be automated. That is typically done with Certbot's hooks, but your situation might need an alternative approach, where SystemD might become handy.

Certbot's deploy-hook

When Certbot detects that a certificate is due for renewal, --pre-hook and --post-hook hooks run before and after each attempt to renew it. If you want your hook to run only after a successful renewal, use --deploy-hook in a command like this.

certbot renew --deploy-hook /path/to/deploy-hook-script

You could place a reload script in /etc/letsencrypt/renewal-hooks/deploy/, as the paths in your question suggests this directory structure is in use.

#!/bin/sh
systemctl reload postfix

SystemD Path units

If you do not trust Certbot to run this when the certificate is renewed and usable, you could use SystemD Path units to monitor the /etc/letsencrypt/live/mail.example.com/fullchain.pem and reload Postfix whenever it changes.

• /etc/systemd/system/mail-certificate-watcher.service:

  [Unit]
  Description=Reload Postfix on mail.example.com certificate changes
  After=network.target
  
  [Service]
  Type=oneshot
  ExecStart=/usr/bin/systemctl reload postfix.service
  
  [Install]
  WantedBy=multi-user.target
  

• /etc/systemd/system/mail-certificate-watcher.path:

  [Path]
  PathModified=/etc/letsencrypt/live/mail.example.com/fullchain.pem
  
  [Install]
  WantedBy=multi-user.target
  

• Remember to enable & start it:

  systemctl enable mail-certificate-watcher.path
  systemctl start mail-certificate-watcher.path