TLS certificate location

Questions
1

Your question

Stalwart has created through the API a CAA record for one of my domains, which I also use elsewhere. This makes it impossible for other servers, using this domain, to obtain a TLS certificate
As I understand, stalwart creates wildcard domain normally, so I might be able to use the wildcard certificate created by Stalwart , and copy it over to my other server / services.
Question: where do I find the TLS certificate files to copy over?

2

Now I have enough. Automatically-issued (ACME) certs are stored in Stalwart’s internal data store, not as files on disk — there’s no filesystem path to copy. To reuse the same cert elsewhere, you’d need to export it via the Certificate object in the WebUI/API rather than looking for a file.

Certificates issued or managed by Stalwart (including ones from ACME) are not written out as loose files on disk by default. They’re stored as Certificate objects in Stalwart’s own data store, and you retrieve them through the WebUI (or API/CLI), not from a filesystem path.

To copy the certificate:

  1. Open the WebUI and go to Settings › TLS › Certificates.
  2. Find the record whose Subject Alternative Names match your domain (the wildcard cert Stalwart obtained).
  3. The record’s certificate field holds the PEM-encoded certificate chain and privateKey holds the PEM-encoded private key, both of which you can copy out and install on your other server.

If you had instead configured the private key with a file reference (e.g. "privateKey": {"@type": "File", "filePath": "/opt/stalwart-smtp/etc/private/tls.key"}), it would live at that path on disk, but for ACME-issued certificates the account keys and certificate material are kept in the data store rather than on the filesystem.

Regarding the CAA record issue: since Stalwart manages CAA automatically for domains under its automatic certificate management, if you need other servers/services to obtain their own certificates for the same domain, you’ll want to either add their CA to the CAA record permissions or switch that domain’s certificateManagement mode so CAA isn’t restricted to Stalwart’s provider only.

Reference: TLS certificates | Stalwart and Certificates | Stalwart

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

Two follow-up questions:

  • is it correct, that by default a wildcard is created? I found the Certificate page, but it lists alternative names (autoconfig.whatev.net, autodiscover.whatev.net, mta-sts.whatev.net, ua-auto-config.whatev.net) … does this mean, there’s no wildcard?
  • in order to use the cert on the other machine, do I need the key file, or is it sufficient to copy what is under Certificate, as PEM format (consisting of three sections). I can export the PEM, but don’t see the key