Skip to content

Certificates, mail and DNS

The certificate of the panel

Server › SSL certificates manages the certificate the panel uses for HTTPS on the name of the server. The same certificate also serves the TLS port of CSP (Central Syslog): a valid certificate lets devices and agents verify the server.

Kind When to use it
Let's Encrypt The normal choice: free, accepted by browsers, renewed by the panel 30 days before it expires
Upload a certificate A certificate from another authority, for example the company one
Self-signed certificate Made by the server, valid 10 years. It encrypts the connection, but every browser warns about it. The installation starts with one of these

Let's Encrypt

Let's Encrypt checks the name over HTTP on port 80:

  • the name of the server must point to the server in the DNS;
  • port 80 must be reachable from the Internet. The firewall of the panel opens it; a router or a provider in front of the server must also let it through.

The request takes a minute; the panel keeps its certificate until the new one is installed. If the request fails, the page shows why: fix it and request again. When a renewal fails, the administrators receive a single message and the panel tries again every day.

Uploading a certificate

Paste, in PEM format:

  • the certificate of the server;
  • the intermediate certificates of the authority: without them, some clients refuse the certificate;
  • the private key, without a password. It is stored encrypted and never shown again.

The panel checks that the key belongs to the certificate, that it covers the name of the server, that it has not expired and that it leads to a trusted authority. An uploaded certificate is not renewed: the panel warns 30 and 7 days before it expires and on the day it expires.

Mail

Server › Mail: the mail the panel sends (notifications, invitations, outcomes of the backups) goes through postfix on this server. postfix only sends: it does not accept mail from outside.

Setting What it holds
Sender The address and the name the mail comes from; empty, panel@ followed by the name of the server. Saving the page confirms it: until then every page reminds you
Receiver of the mail of the system Where the mail of the server for root and postmaster goes, and the mail that could not be delivered. Set an address you read
Delivery Direct: postfix delivers to the servers of the recipients, or Through a relay: postfix hands everything to another SMTP server, such as the one of your company, Microsoft 365 or a sending service

The mail to the customers of a reseller keeps the sender of the server, but carries the name of the brand of the reseller, and the replies go to the support address of their brand.

Use a relay when the provider of the server blocks port 25, or when the mail ends up in spam.

Making the mail arrive

For direct delivery, the servers of the recipients trust the mail when:

  • the reverse name of each address the server sends from, IPv4 and IPv6, is the name of the server. The provider of the address sets it;
  • the SPF record of the domain of the sender authorizes the server. With the default sender, the record v=spf1 a -all on the name of the server is enough.

If the SPF does not authorize the server, the page shows the record to publish and the DMARC policy of the domain, which says what happens to the mail meanwhile; every page reminds you until it is fixed. With a relay, the SPF concerns the provider of the relay.

The Queue shows the mail postfix could not deliver yet: it tries again by itself for a few days. The Test message checks that a message leaves and arrives.

DNS

Server › DNS sets, in How it finds the names, the resolver of the server, which finds the addresses of the names for the panel, the mail, the certificates and the modules. It keeps the answers in its cache and answers only the server itself.

Mode When to use it
By itself, from the root servers, checking the DNSSEC signatures The normal choice: the resolver asks the servers of each domain directly and checks the DNSSEC signatures. It does not depend on the DNS of the provider, and the antispam lists, which refuse the questions of public resolvers, answer it
By asking other resolvers, such as those of the provider When the provider blocks DNS towards the Internet: the resolver asks the resolvers you give, usually those of the provider. The signatures are not checked

Private domains: the domains that exist only in your network, such as company.lan, are not known on the Internet: give the DNS of the network that knows them. They are needed, for example, by the UCP (Uptime Check) checks towards internal machines.

Changing the mode empties the cache: for a moment the names are looked up again. If the resolver does not answer, the installation keeps the resolver the server had.