Configure Lets Encrypt Cert in Postfix

Configure Lets Encrypt Cert in Postfix in a RHEL7 server
============================================================================================

1. Install Apache Web Server
--------------------------------------

$ sudo yum groupinstall -y "Web Server"
$ sudo vim /etc/hosts
    - add: 1.2.3.4 host.example.com example.com
$ sudo vim /etc/hostname
    - add: host.example.com
$ sudo vim /etc/httpd/conf/httpd.conf
    - set the ServerName directive in the /etc/httpd/conf/httpd.conf file
$ sudo vim /etc/httpd/conf.d/ssl.conf
    - set the ServerName directive in the /etc/httpd/conf.d/ssl.conf file
$ sudo hostname -f /etc/hostname
$ sudo systemctl enable httpd
$ sudo systemctl start httpd

+ Open port 80 and 443 in AWS firewall rules in your AWS/EC2 instance console

+ Make sure you have installed the latest version of OpenSSL in your server.
$ sudo yum update openssl

+ Tune Apache 2.4 TLS configuration
$ sudo vim /etc/httpd/conf.d/ssl.conf
    - SSLProtocol TLSv1.2
    - SSLHonorCipherOrder On
    - SSLCipherSuite "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES128:RSA+AESGCM!aNULL:!MD5:!DSS:!LOW:!MEDIUM"
    - Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    - Header always set X-Frame-Options DENY
    - Header always set X-Content-Type-Options nosniff
    # Requires Apache >= 2.4
    - SSLCompression off
$ sudo apachectl restart

2. Install Lets Encrypt CA - CertBot
--------------------------------------

$ sudo yum-config-manager --enable rhui-REGION-rhel-server-extras
$ sudo yum-config-manager --enable rhui-REGION-rhel-server-optional
$ sudo yum repolist all
$ wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
$ sudo rpm -Uvh epel-release-latest-7*.rpm
$ sudo yum install python-certbot-apache
$ sudo certbot --apache

+ Your certificate and chain have been saved at /etc/letsencrypt/live/<domain>
+ Lets encrypt certificates expire 90 days after they were issue.
+ To obtain a new or tweaked version of this certificate in the future,
    simply run certbot again with => certbot --apache certonly
+ To non-interactively renew *all* of your certificates,
    run with => certbot renew --dry-run
+ If that appears to be working correctly, you can arrange for automatic renewal
    by adding a cron or systemd job which runs the
    following => certbot renew --quiet

3. Install Postfix

$ sudo yum install postfix
$ sudo /etc/postfix/main.cf
    - myhostname = host2.ite.lat
    - mydomain = ite.lat
    - myorigin = $mydomain
    - inet_interfaces = $myhostname, localhost
    - mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
                      mail.$mydomain, web.$mydomain
    - mynetworks = 127.0.0.0/8, 172.31.42.125, 52.43.65.253, 192.100.230.21
    - smtpd_banner = host ESMTP Sendmail 2.1
    - smtpd_use_tls= yes
    - smtp_use_tls = yes
    - tls_preempt_cipherlist = yes
    - smtpd_tls_security_level = may
    - smtpd_tls_auth_only = yes
    - smtpd_tls_cert_file=/etc/letsencrypt/live/web.ite.lat/fullchain.pem
    - smtpd_tls_key_file=/etc/letsencrypt/live/web.ite.lat/privkey.pem
    - smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
    - smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
    - smtpd_tls_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1
    - smtpd_tls_ciphers = high
    - smtpd_tls_mandatory_ciphers = high
    - smtp_tls_ciphers = high
    - smtp_tls_mandatory_ciphers = high
    - tls_high_cipherlist = ECDH+aRSA+AES256:ECDH+aRSA+AES128:AES256-SHA:AES128+EECDH:AES128+EDH

 $ sudo postfix stop
 $ sudo postfix start

+ To run a complete STARTTLS handshake with the MTA do: (optional)

$ openssl s_client -connect mail.ite.lat:25 -starttls smtp

+ You can enable STARTTLS log details with these settings to see which emails are
    sent/received encrypted: (optional for debugging)

$ sudo /etc/postfix/main.cf
    - smtp_tls_loglevel = 1
    - smtpd_tls_loglevel = 1

+ To test your Postfix MTA with SMTP you can use a text user interface MUA for send/receiving email
  and the following online SMTP test tools. (Alpine will be used as the MUA)

$ sudo yum install alpine
$ alpine

    + Configure Alpine with your MTA info:
    - SETUP (S) -> Config (C)
        - Personal Name         =   Meme delaTower
        - User Domain           =   ite.lat
        - SMTP Server           =   mail.ite.lat

+ Perform the following test on your secured MTA.

    + SMTP receiver test
        - http://www.checktls.com/perl/TestReceiver.pl
    + SMTP sender test
        - http://www.checktls.com/perl/TestSender.pl