Phase 5: Share Dokploy’s certificate with Stalwart

Dokploy’s certificate currently protects:

https://mail.example.com

But mail clients connect directly to:

mail.example.com:465
mail.example.com:993

These connections do not pass through Traefik.

Stalwart therefore needs its own access to the trusted certificate and private key.

5.1 Locate Traefik’s ACME storage

On many Dokploy installations, the ACME file is located at:

/etc/dokploy/traefik/dynamic/acme.json

Verify it:

sudo ls -lh /etc/dokploy/traefik/dynamic/acme.json

The file should exist and have a nonzero size.

Do not print or share its contents. It contains private keys and certificate material.

The exact location can change between Dokploy versions, so verify the path on your server.

5.2 Add a certificate-extraction container

Update the Compose file:

services:
  stalwart-mail:
    image: stalwartlabs/stalwart:v0.16
    restart: unless-stopped

    environment:
      STALWART_PUBLIC_URL: https://mail.example.com

    ports:
      - "25:25"
      - "465:465"
      - "587:587"
      - "993:993"

    expose:
      - "8080"

    volumes:
      - stalwart_config:/etc/stalwart
      - stalwart_data:/var/lib/stalwart
      - stalwart_certs:/data/certs:ro

  stalwart-cert-dumper:
    image: ghcr.io/kereis/traefik-certs-dumper:latest
    restart: unless-stopped
    network_mode: none

    environment:
      ACME_FILE_PATH: /traefik/acme.json
      DOMAIN: mail.example.com
      OVERRIDE_UID: "2000"
      OVERRIDE_GID: "2000"

    volumes:
      - /etc/dokploy/traefik/dynamic/acme.json:/traefik/acme.json:ro
      - stalwart_certs:/output

volumes:
  stalwart_config:
  stalwart_data:
  stalwart_certs:

Do not add a hostname: property.

Redeploy the application.

5.3 Verify the extracted certificate

Open a terminal inside the stalwart-mail container:

ls -la /data/certs

Expected files:

cert.pem
key.pem

Inspect the certificate:

openssl x509 \
  -in /data/certs/cert.pem \
  -noout \
  -subject \
  -issuer \
  -dates \
  -ext subjectAltName

The SAN list must contain:

DNS:mail.example.com

5.4 Add the certificate in Stalwart

Navigate to:

Settings
→ TLS
→ Certificates
→ Add Certificate

Create a certificate entry:

Name:
dokploy-mail

Certificate source:
File

Certificate path:
/data/certs/cert.pem

Private key source:
File

Private key path:
/data/certs/key.pem

Set it as the default TLS certificate.

Confirm the Stalwart default hostname is:

mail.example.com

Then use:

Management
→ Actions
→ Reload TLS certificates

If no reload action is available, restart only the Stalwart container.

5.5 Verify direct TLS

From another computer:

openssl s_client \
  -connect mail.example.com:465 \
  -servername mail.example.com \
  </dev/null 2>/dev/null |
openssl x509 -noout -subject -issuer -dates

Then test IMAP:

openssl s_client \
  -connect mail.example.com:993 \
  -servername mail.example.com \
  </dev/null 2>/dev/null |
openssl x509 -noout -subject -issuer -dates

Both should present a trusted certificate for mail.example.com.