Installs the certificate for the selected Dovecot service and checks it locally over TLS or STARTTLS.
What happens
- The service agent on the server fetches the task from the appliance over outbound HTTPS, port 443.
- Finds Dovecot certificate bindings, local IMAP/POP ports and observable references from other certificate tools. Checks the selected binding before changing it.
- Stages and validates the certificate and key. If other services use the same files, only the selected Dovecot binding gets its own pair; shared files and renewal jobs are preserved.
- Switches the files and reloads only Dovecot. If it fails: A partial file switch or loss of a previously working local TLS connection restores the files and affected configuration. Rollback is checked against the previous state; unconfirmed recovery is reported as an error.
- Compares the locally served certificate fingerprint over TLS or IMAP/POP STARTTLS. The new certificate means success; an already correct state means success without changes. Missing local evidence gives a warning. If the old certificate is still served after one extra reload, reports failure without blind rollback.
Technical details
- Connection
- The package runs through the service agent on the server. The agent connects over outbound HTTPS to the appliance, port 443 by default. You open no port into the server.
- Service ports
- 110, 143, 993, 995
- You need
- The service agent installed on the server. The account needs to write certificate and key files with their existing permissions and reload Dovecot. Sudo can be limited to fixed Dovecot commands. A shared certificate binding also needs read and write access to the selected configuration. Without root, replacement files may belong to the account; group and permissions are preserved, and the change is reported as a warning.
- Actions
- Discovery, Installation, Verification, Rollback
- Packages
-
dovecot-ssh1.3.1 - Note
-
- Discovery reads the configuration file the running Dovecot was started with (the master process's -c, else the systemd unit, else the file doveconf reports), with its !include files. The fixed paths under /etc/dovecot are used only when the service cannot answer. Deploy and rollback also accept files outside the standard folders when the live configuration uses exactly that certificate and key and doveconf confirms it.
- The fingerprint identifies the served certificate; it does not verify its name or trust chain. Another local binding's certificate gives a deployment warning. Discovery can report only the certificate tools it can observe.
- Requires Bash, OpenSSL, GNU coreutils and flock. Expanded discovery and shared-binding handoff require Python 3.6 or newer. Configuration paths and recovery journals are also read on Alpine/musl with these tools installed. Service and local TLS port selections are optional.