Let's Encrypt Without a Web Server: Standalone Mode for Mail and Other Services

Mail servers, MQTT brokers and other services need TLS certificates too, often on machines with no website. Certbot's standalone mode runs its own temporary web server for validation, and a deploy hook reloads your service after each renewal.

Full guide: Full Let's Encrypt guide

1. Install Certbot

sudo apt install certbot

2. Open port 80 for validation

Standalone mode listens on port 80 for a few seconds during each request and renewal.

sudo ufw allow 80/tcp

3. Request the certificate

Nothing else may be using port 80 while it runs.

sudo certbot certonly --standalone -d mail.example.com

4. Point your service at the files

For example Postfix and Dovecot.

# Postfix (main.cf)
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file  = /etc/letsencrypt/live/mail.example.com/privkey.pem
# Dovecot (10-ssl.conf)
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key  = </etc/letsencrypt/live/mail.example.com/privkey.pem

5. Reload the service after renewal

Scripts in the deploy hooks folder run after every successful renewal.

echo -e '#!/bin/sh\nsystemctl reload postfix dovecot' | sudo tee /etc/letsencrypt/renewal-hooks/deploy/reload-mail.sh
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-mail.sh

6. Verify

sudo certbot renew --dry-run
openssl s_client -connect mail.example.com:465 < /dev/null 2>/dev/null | openssl x509 -noout -subject -enddate

7. Troubleshooting

Problem binding to port 80: something else is listening; stop it with –pre-hook and –post-hook, or use the DNS challenge instead. Service still serves the old certificate: the deploy hook did not run or did not reload the right service.

sudo ss -tlpn | grep ':80 '

FAQ

Can I use standalone mode if port 80 is blocked?

No. Use the DNS-01 challenge with a DNS plugin instead; it needs no open ports.

Does Mailcow need this?

No. Mailcow requests and renews its own Let's Encrypt certificates automatically.

Further reading: Certbot user guide