fix(mail): reconcile mounted Let's Encrypt certificates into daemon paths on boot - #838
Conversation
…aths on boot Postfix and Dovecot inside the openship-mail container load certificates from /etc/ssl/certs/iRedMail.crt and /etc/ssl/private/iRedMail.key. Because /etc/ssl is ephemeral, container recreations and image updates revert to the baked self-signed certificates even when valid certificates are mounted at /etc/letsencrypt. This reconciles /etc/letsencrypt certificates on every boot into the daemon paths if present, ensuring TLS clients never fail with self-signed certificate errors. Fixes oblien#837
|
Updated this PR branch for the current architecture and retargeted it to The startup repair now validates the certificate hostname, validity period, server usage, and matching private key before switching iRedMail to the mounted certificate. It repairs the certificate and key independently, follows stable Let’s Encrypt live paths for renewal, and retains the fallback files when no valid mounted pair exists. Validation: 10 Docker tests passed with real OpenSSL certificates and a TLS handshake, covering stale key links, repeat starts, renewal, container recreation, invalid certificates, and apex SAN/wildcard certificates. API typechecking passed. CI also exposed two older integration test fixture problems; those were corrected on the integration branch and merged into this PR. All CI jobs passed in run 35008541433. This original PR is now merged into the bug-fix branch through 1a4f535, awaiting the eventual merge to main. |
1a4f535
into
oblien:feat/bugfix-integration-2026-09-15
2 participants
Summary
Postfix and Dovecot inside the \openship-mail\ container load certificates from /etc/ssl/certs/iRedMail.crt\ and /etc/ssl/private/iRedMail.key.
Because /etc/ssl\ is inside the ephemeral container layer (not a persistent volume), recreating the container or updating the image reverts /etc/ssl\ to the baked self-signed certificates — even when valid certificates are mounted at /etc/letsencrypt.
As a result, applications and clients connecting via STARTTLS on port 587 or SSL on 465 (like Node.js / nodemailer, Python, or mail clients) fail with:
\
Error: self-signed certificate (code: ESOCKET, command: CONN)
\\
This PR adds a reconciliation step (\3c) to \�pps/email/docker/entrypoint.sh\ that checks for \mail.\ (or \) under /etc/letsencrypt/live/\ on every boot and symlinks \ ullchain.pem\ and \privkey.pem\ into the default daemon certificate paths.
Fixes #837
Verification
odemailer.createTransport().verify()) succeeds without certificate rejection