Certificate handling is the most important recurring operational concern in this architecture.

There are two certificate layers:

Web HTTPS:
Traefik serves its own certificate.

Mail protocols:
Traefik ACME data
→ certificate dumper
→ shared volume
→ Stalwart

Traefik renews the Let’s Encrypt certificate.

The certificate dumper updates:

/data/certs/cert.pem
/data/certs/key.pem

Stalwart must then reload those files.

Monthly certificate check

Check SMTP:

openssl s_client \
  -connect mail.example.com:465 \
  -servername mail.example.com \
  </dev/null 2>/dev/null |
openssl x509 -noout -subject -issuer -dates

Check IMAP:

openssl s_client \
  -connect mail.example.com:993 \
  -servername mail.example.com \
  </dev/null 2>/dev/null |
openssl x509 -noout -subject -issuer -dates

Set a reminder at least 30 days before expiration.

Renewal procedure

When Traefik renews the certificate:

1. Inspect the certificate-dumper logs.

2. Confirm cert.pem has a new expiration date.

3. Open Stalwart administration.

4. Run Reload TLS certificates.

5. Retest ports 465 and 993 externally.

6. If Stalwart still serves the old certificate, restart only the Stalwart container.

Check the extracted certificate inside the container

CONTAINER=$(docker ps \
  --filter name=stalwart-mail \
  --format '{{.Names}}' |
  head -1)

docker exec "$CONTAINER" \
  openssl x509 \
  -in /data/certs/cert.pem \
  -noout \
  -subject \
  -issuer \
  -dates

Check certificate-dumper logs

DUMPER=$(docker ps \
  --filter name=stalwart-cert-dumper \
  --format '{{.Names}}' |
  head -1)

docker logs --since 1h "$DUMPER"

Certificate failure recovery

If secure IMAP or SMTP begins failing:

1. Confirm mail.example.com still resolves correctly.

2. Confirm Dokploy’s web certificate is valid.

3. Confirm the ACME file exists.

4. Confirm the dumper produced cert.pem and key.pem.

5. Confirm the Stalwart certificate paths are correct.

6. Reload TLS certificates.

7. Restart Stalwart if necessary.

8. Verify ports 465 and 993 again.

Security checklist

Use separate accounts:

Administrator account:
Used only for administration

Mailbox account:
Used by mail, calendar, and contact clients

Recommended security settings:

Administrator 2FA enabled
Strong unique mailbox password
App password for clients when using 2FA
No open SMTP relay
Permissive CORS disabled
HSTS enabled
Port 8080 not published publicly
Unused mail ports not published
Production image pinned to a tested release
Offsite backups enabled

Public ports should normally be limited to:

25
465
587
993

Ports 80 and 443 remain managed by Dokploy.