TLSA Record Automation

This directory contains scripts to automatically update TLSA/DANE records when certificates are renewed.

Setup

1. Install Systemd Timer (Recommended)

sudo cp /var/deploy/scripts/tlsa-timer.service /etc/systemd/system/
sudo cp /var/deploy/scripts/tlsa-timer.timer /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable tlsa-timer.timer
sudo systemctl start tlsa-timer.timer

The timer will:

Run 5 minutes after boot
Check every hour for certificate changes
Update TLSA records automatically when certificates change

2. Manual Setup (Alternative)

Add to crontab:

crontab -e
# Add this line:
0 * * * * /var/deploy/scripts/tlsa-monitor.sh >> /var/deploy/scripts/tlsa-cron.log 2>&1

3. DNS Provider API Configuration (Optional)

To enable automatic DNS updates via your DNS provider's API, set these environment variables:

export DNS_API_KEY="your-api-key"
export DNS_API_PASSWORD="your-api-password"
export DNS_CUSTOMER_NUMBER="your-customer-number"

Or add to /var/deploy/scripts/update-tlsa.sh:

dnsApiKey="your-api-key"
dnsApiPassword="your-api-password"
dnsCustomerNumber="your-customer-number"

Note: DNS provider API integration is not yet fully implemented. Currently, the script logs the required TLSA values for manual DNS updates. You'll need to implement the API call for your specific DNS provider.

Manual TLSA Record Update

If automation is not set up, run manually after certificate renewal:

/var/deploy/scripts/update-tlsa.sh

This will output the TLSA records that need to be added/updated in your DNS provider.

Current TLSA Hash

The current certificate hash is:

5206c4482b4378bd3e86d22d7afd8f341eec95aa999aeff7d94454c197223418

Add these TLSA records in your DNS provider:

_25._tcp.mail.nasarek.dev → 3 1 1 5206c4482b4378bd3e86d22d7afd8f341eec95aa999aeff7d94454c197223418
_465._tcp.mail.nasarek.dev → 3 1 1 5206c4482b4378bd3e86d22d7afd8f341eec95aa999aeff7d94454c197223418
_587._tcp.mail.nasarek.dev → 3 1 1 5206c4482b4378bd3e86d22d7afd8f341eec95aa999aeff7d94454c197223418

Verification

Check if TLSA records are published:

dig +short TLSA _25._tcp.mail.nasarek.dev
dig +short TLSA _465._tcp.mail.nasarek.dev
dig +short TLSA _587._tcp.mail.nasarek.dev

Troubleshooting

Check logs: /var/deploy/scripts/tlsa-update.log
Test script manually: /var/deploy/scripts/tlsa-monitor.sh
Verify certificate: openssl x509 -in /var/deploy/mailcow/data/assets/ssl/cert.pem -noout -dates

2.5 KiB Raw Blame History