Postal web UI https isn't valid

[mu-arch]

I'm getting a problem when I visit my site where the HTTPS isn't valid. The website still works if I bypass the warning.

[iammattmartin]

Do you mean the admin GUI?

You'll need to add your own certificate in the configuration for nginx.

[adamcooke]

As @mattmartincouk said, the instructions just generate a self signed certificate. You'll need to replace /etc/nginx/ssl/postal.crt and /etc/nginx/ssl/postal.key with new values for a real certificate suitable for the domain you're accessing the UI from.

[iammattmartin]

LE does the link tracking hosts - not the admin GUI.

[mu-arch]

Hmm, any suggestions on a way to use a LE cert that auto renews?

[iammattmartin]

Yes, use LE to do that - very easy to do and it'll achieve what you want.

[adamcooke]

Let's Encrypt is just used for click & open tracking domains. For example if you want to track links on emails you send from yourdomain.com, to improve deliverability we recommend using a subdmomain like click.yourdomain.com for tracking. Postal will manage certificates for this domain and renew them automatically.

If you want to set up LE for your management UI you can use something like CertBot with nginx.

[mu-arch]

I haven't heard of certbox before! That is awesome :)

Thanks for the quick advice as always!

[adamcooke]

You'll need something like the below to generate the cert.

sudo certbot certonly --webroot -w /opt/postal/app/public -d mail.yourdomain.com

You'll also need to update the cert paths in the nginx configuration to the new certs that LE generates for you.

[mu-arch]

This information should defiantly be added as a note in the installation process I think.

[adamcooke]

I agree. Will add a note about this tomorrow.

[mu-arch]

Is there any way I can commit to the Github wiki? I would gladly offer some edits I think would be more clear about certain things.

[adamcooke]

Sadly it appears there's no way to submit pull requests to the wiki on GitHub. Please feel free to just add issues for any updates and I'll get them updated.

[mu-arch]

After running Certbot it only gave me a single .pem file. Is that correct?

[adamcooke]

You should find a few files in /etc/letsencrypt/live/domain.com. You should have fullchain.pem and privkey.pem.