SSL & DNS

Issue SSL certificate

cx1-add-ssl.sh acme.co.uk
# Obtains cert for acme.co.uk + www.acme.co.uk
# Redirects HTTP → HTTPS automatically
# Updates Postfix + Dovecot TLS config
# Switches Roundcube to verified SSL

Check certificate renewal

certbot renew --dry-run        # test renewal
systemctl status certbot.timer  # auto-renewal timer

Full DNS record set per domain

; Web
A     acme.co.uk         SERVER_IP
A     www.acme.co.uk     SERVER_IP

; Mail
A     mail.acme.co.uk    SERVER_IP
MX    acme.co.uk         mail.acme.co.uk  10

; Anti-spam
TXT   acme.co.uk         "v=spf1 mx ~all"
TXT   _dmarc.acme.co.uk  "v=DMARC1; p=none; rua=mailto:postmaster@acme.co.uk"
TXT   mail._domainkey.acme.co.uk  "(value from cx1-add-dkim.sh)"

List all certificates

certbot certificates