TLS certificates

Every web address uses HTTPS. The full steps are in docs/TLS.md in the yanu-infra repo.

What is covered

• One Let's Encrypt certificate (named smsyanu.com) covers smsyanu.com, www, app, auth, api, smpp and docs.
• Each reseller domain gets its own certificate.
• SMPP on port 2775 is plain SMPP 3.4. It is protected by the IP allowlist, not by TLS.

How renewal works

• certbot's own timer (certbot.timer) renews about 30 days before expiry.
• After a renewal, a deploy hook reloads nginx so it uses the new certificate.
• The certificate authority emails expiry warnings to the address used at first issue. Use a mailbox Deltacomm reads.

Check expiry

On the server:

certbot certificates
systemctl list-timers certbot.timer
certbot renew --dry-run

From any computer:

echo | openssl s_client -connect docs.smsyanu.com:443 -servername docs.smsyanu.com 2>/dev/null \
  | openssl x509 -noout -enddate

Repeat for each host. Under 14 days left means renewal is failing.

If renewal fails

1. Check DNS still points the host to the server. If the host is behind the Cloudflare proxy, check the challenge on port 80 still reaches the server (start with "DNS only" if in doubt).
2. Check port 80 is open on the server firewall. nginx serves /.well-known/acme-challenge/ from /var/www/certbot.
3. Look at /var/log/letsencrypt/letsencrypt.log.
4. Fix the cause, run certbot renew, then nginx -t && systemctl reload nginx.

Add a new SMS YANU host name

1. Add it to the names list in scripts/tls-issue.sh in yanu-infra and run the script again. It expands the same certificate.
2. Add the nginx site, then nginx -t && systemctl reload nginx.

New reseller domain

1. The reseller points the domain at the server.
2. Issue its certificate: certbot certonly --webroot -w /var/www/certbot -d sms.partner.mw (use the real domain).
3. Add the nginx site from nginx/sites/reseller-domain.conf.template in yanu-infra and deploy it.
4. Add the reseller's theme for that domain. See Adding a reseller.