I am trying to move from Comodo to Let's Encrypt certificates on OS X Server (10.7).
Something in Apple's server.app and ServerAdmin.app is broken. I can see and select newly imported certificates in server.app but after a few seconds and re-opening the dialog the selected certificates are back to the original value. In "Server Admin" > Mail > Advanced tab I can select the new certificates and they stick. However the imap and smtp services still use the old certificate.
I see that for the old certificate there are 4 files in
I know that the only the old certificate is in
/etc/certificates/ because SHA1 of the new certificate, looked up with:
$ openssl x509 -in host.domain.tld.cer -noout -fingerprint -sha1 | cut -f2 -d'=' | sed 's/://g'`)
, is showing a different SHA1.
According to certbot4osx source code, it looks like the
security import command should
- import the certificate into the system keychain, and
- create the
After a reboot only 3 files, .cert, .chain and .concat, are there in
/etc/certificates/, not .key.
How to get all the 4 Let's Encrypt certificate files correctly in
/etc/certificates/ and without reboot?