SSL is an integral part of today's web experience. Sites like Google penalize sites -- ANY sites -- that do NOT use SSL, so having a solid SSL implementation for any of your domains means your users will have safe and secure browsing experience. In addition, it eliminates that pesky "Safe Browsing" warning that Google displays for sites that don't utilize SSL and that tend to scare users.

While implementing SSL is a wise move, it comes with a cost. A standard SSL certificate is relatively inexpensive, and if you use a site like SSL Shopper you can find single-use SSL certs for as low as $17/year. "Single-use" means that those inexpensive certificates are only good for a single domain. If you have multiple different domains to secure, or multiple second- and third-level domains like "support.yourdomain.com" or, for our purposes, "mail.yourdomain.com" you'll need a wildcard certificate for each top level domain (which secures anything.yourdomain.com) or possibly a UCC, which can be used to secure multiple single domains. These types of certs aren't so inexpensive.

That's where a service like Let's Encrypt comes into play. Let's Encrypt is a free, open and automated Certifying Authority. Unlike places such as GeoTrust or Trustwave, the SSL certificates issued by Let's Encrypt have zero cost. However, their certificates are just as secure and reliable as paid certs. The difference is that Let's Encrypt is like any open source product: while free, it may lack some of the nuance of paid services. That's to say that using a Let's Encrypt cert is slightly more work than using something from GeoTrust. For example, you have to "enroll" the certificate in the server's Certificate Store plus you have to handle automated renewals of the Let's Encrypt certificate. In addition, some options aren't available as of yet, such as wildcard certificates. However, the Let's Encrypt community is rapidly growing and they've announced wildcard support is on the horizon. Even with the limitations, the effort required for using Let's Encrypt is well worth it. Below we'll run through how we've implemented Let's Encrypt for our installation of SmarterMail and how we're handling both the enrollment of the cert AND the automated renewal.

While there's nothing built directly into SmarterMail to handle Let's Encrypt certificates and their enrollment, you can leverage one of their many Windows clients to handle this in a number of ways. One solution that we've found to be the easiest is to use the Certify client to handle the enrollment of the certificate. (This will also handle certificate renewal.) Once the certificate has been set up using this utility, you will need to automate the process of exporting the certificate into a PFX format containing the private key. (You'll need to do this since SmarterMail does not tap into the certificate store directly but instead references direct PFX and .CER files assigned to your ports.) This can be accomplished with PowerShell, and the script you need is below. Just be sure to modify the parameters of the script to match your environment. You can then set up a Scheduled Task within Windows to call this PowerShell script on a daily basis, and it will keep the certificate up-to-date. Finally, just secure your ports per our KB instructions and point it to the PFX file exported by the script.

The big caveat to this solution is that it's not free if you're securing more than one IIS site. So if you're only securing SmarterMail, it will work great. However, if you wanted to use this for your other websites as well, you would need to purchase the license for the Certify client or find another method, such as the ACME client. If you go with the ACME solution, it seems to be pretty straight forward and uses PowerShell modules, so this can be performed remotely as well. Here's their quickstart guide that walks you through their process, and also details how to export as PFX at the end of the article.