Import certificate on Stalwart Windows within running state and re-read certs

Questions
1

Your question

I try to use a RSA certificate for SMTP and Stalwart isn’t able to issue a RSA certificate.
Therefor I try to get my Win-Acme issued certificate imported and still need a solution for automated re-read of the certificate in file, which is declared at the cert in path variable.
Is there any way to re-read the certificate via cli without restarting the full service?

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

I have enough now. Let me check the actions doc for the exact TLS certificate reload section.

I have enough now.

Yes. Use the ReloadTlsCertificates action, which re-reads TLS certificates from disk (or the configured ACME store) without restarting the server.

Import the certificate as a Certificate object first (e.g. via WebUI under Settings > TLS > Certificates, or with a JSON Certificate object pointing at the cert/key files), then trigger the reload from the CLI:

stalwart-cli create action/ReloadTlsCertificates

This can also be triggered from the WebUI under Management > Actions, and is a lighter-weight operation than a full ReloadSettings. This works the same way regardless of platform, including Windows, since it goes through the JMAP-based management API rather than a signal or restart.

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

Stalwart’s ACME only issues ECDSA P-256 keys, so win-acme is the right route for RSA. Have it write PEM files with an unencrypted key (the PemFiles store, not a PFX or the Windows certificate store) and point the Certificate object at those files. Then, after each renewal, run:

stalwart-cli --url https://mail.example.com --api-key <TOKEN> create action/ReloadTlsCertificates

That re-reads the files and swaps the certificates in place, so new SMTP, IMAP and HTTPS connections pick up the new one without a restart. It fits in win-acme’s installation script step, and the API key only needs the sysActionCreate and actionReloadTlsCertificates permissions.

Make sure renewal happens before the old certificate expires. If the file is already expired when a reload or restart happens, the server removes that Certificate object, and a renewed file won’t be picked up until you recreate it.