How to Create a Domain, Issue Let's Encrypt, and Configure DANE with TLSA Records in Plesk Make it Rain Paper

Pre-requirements

• Administrator access to the Plesk control panel.
• Root or sudo access to the server via SSH.
• Basic knowledge of DNS records, SSL certificates, and email security (DANE).
• Installed hash-slinger package for generating TLSA records.
• DNSSEC support on your domain's DNS.

Introduction

In this guide, you will learn how to create a domain in Plesk, issue a Let's Encrypt certificate, and configure DNSSEC and DANE (DNS-based Authentication of Named Entities) using TLSA records. DANE ensures secure email communication through cryptographic authentication tied to the DNS system.

Step 1: Create a Domain in Plesk

1. Log into the Plesk control panel.
2. Navigate to Domains and click Add Domain.
3. Enter example.com as the domain name and complete the setup steps.

Step 2: Issue a Let's Encrypt Certificate for the Domain

1. Navigate to Domains > example.com > SSL/TLS Certificates.
2. Click Get it free under the Let's Encrypt section.
3. Follow the instructions to issue the Let's Encrypt certificate for the domain.

Step 3: Install the hash-slinger Package

The hash-slinger package is required to generate the TLSA record. To install it, follow these steps:

Linux Command to Install hash-slinger

# For CentOS/RHEL
yum install hash-slinger

# For Ubuntu/Debian
sudo apt-get install hash-slinger

Step 4: Find the Certificate File for the Domain

Once the certificate is issued, locate the certificate file for example.com using the following command:

Linux Command to Find the Certificate File

plesk db "select cert_file from certificates where name like '%example.com%'"

This command will return the name of the certificate file, which you will use in the next step.

Step 5: Generate the TLSA Record for Mail Server

1. Switch to the directory where the certificate files are stored:

cd /usr/local/psa/var/certificates/

1. Using the certificate file name from Step 4, generate a TLSA record for mail.example.com on port 25:

tlsa --create --selector 1 -p25 --certificate [certificate-file-name] mail.example.com

Note: Replace [certificate-file-name] with the name of the certificate file you found in Step 4.

Step 6: Add the TLSA Record in Plesk

1. Go to Domains > example.com > Hosting & DNS > DNS.
2. Click Add Record.
3. Using the TLSA values generated in Step 5, create a new TLSA record for mail.example.com.
4. Click OK to save and apply the changes.

Step 7: Install and Enable DNSSEC

1. Navigate to Extensions > Extensions Catalog > DNS.
2. Find the DNSSEC extension and click Get It Free to install it.
3. Once installed, go to Domains > example.com > Hosting & DNS > DNSSEC.
4. Click Sign the DNS Zone to enable DNSSEC.

Note: For DNSSEC, choose the algorithm RSASHA256 to secure the DNS zone.

Step 8: Verify DANE Configuration

After configuring the TLSA record and enabling DNSSEC, verify that DANE is properly set up using the DANE Validator tool:

1. Go to MailHardener DANE Validator.
2. Enter mail.example.com and click Inspect.
3. The tool will show the configured TLSA DNS record and report if DANE is properly configured for your mail server.

Gotchas to Avoid

• Ensure the hash-slinger package is installed on your system before generating TLSA records.
• Verify that your DNS provider supports DNSSEC and that it is properly configured.
• Ensure that the DNS records for mail.example.com are propagated before verifying DANE.

Linux Commands for Managing Certificates and TLSA Records

Find Certificate File

plesk db "select cert_file from certificates where name like '%example.com%'"

Generate TLSA Record

tlsa --create --selector 1 -p25 --certificate [certificate-file-name] mail.example.com

Verify DNSSEC

Use dig to verify that DNSSEC is properly configured:

dig +dnssec example.com

By following this guide, you have successfully created a domain in Plesk, issued a Let's Encrypt certificate, configured DNSSEC, and set up a TLSA record for DANE. Ensuring proper DNSSEC and DANE configuration enhances email security by providing cryptographic authentication for your mail server. For more information on secure email configuration, visit our Knowledge Base.