diff --git a/docker-compose.yml b/docker-compose.yml
index 13c5b09b..f9d3a026 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,244 +1,247 @@
 version: '3'
 services:
   coturn:
     build:
       context: ./docker/coturn/
     container_name: kolab-coturn
     healthcheck:
       interval: 10s
       test: "kill -0 $$(cat /tmp/turnserver.pid)"
       timeout: 5s
       retries: 30
     environment:
       - TURN_PUBLIC_IP=${COTURN_PUBLIC_IP}
       - TURN_LISTEN_PORT=3478
       - TURN_STATIC_SECRET==${COTURN_STATIC_SECRET}
     hostname: sturn.mgmt.com
     image: kolab-coturn
     network_mode: host
     restart: on-failure
     tty: true
   kolab:
     build:
       context: ./docker/kolab/
     container_name: kolab
     depends_on:
       mariadb:
         condition: service_healthy
     extra_hosts:
       - "kolab.mgmt.com:127.0.0.1"
     environment:
       - DB_HOST=${DB_HOST}
       - DB_ROOT_PASSWORD=Welcome2KolabSystems
       - DB_HKCCP_DATABASE=${DB_DATABASE}
       - DB_HKCCP_USERNAME=${DB_USERNAME}
       - DB_HKCCP_PASSWORD=${DB_PASSWORD}
       - DB_KOLAB_DATABASE=kolab
       - DB_KOLAB_USERNAME=kolab
       - DB_KOLAB_PASSWORD=Welcome2KolabSystems
       - DB_RC_USERNAME=roundcube
       - DB_RC_PASSWORD=Welcome2KolabSystems
+      - SSL_CERTIFICATE=/etc/letsencrypt/live/${APP_WEBSITE_DOMAIN:?err}/cert.pem
+      - SSL_CERTIFICATE_FULLCHAIN=/etc/letsencrypt/live/${APP_WEBSITE_DOMAIN:?err}/fullchain.pem
+      - SSL_CERTIFICATE_KEY=/etc/letsencrypt/live/${APP_WEBSITE_DOMAIN:?err}/privkey.pem
       - IMAP_HOST=127.0.0.1
       - IMAP_PORT=11993
       - MAIL_HOST=127.0.0.1
       - MAIL_PORT=10587
     healthcheck:
       interval: 10s
       test: test -f /tmp/kolab-init.done
       timeout: 5s
       retries: 30
     hostname: kolab.mgmt.com
     image: kolab
     network_mode: host
     tmpfs:
       - /run
       - /tmp
       - /var/run
       - /var/tmp
     tty: true
     volumes:
       - ./ext/:/src/:ro
       - /etc/letsencrypt/:/etc/letsencrypt/:ro
       - ./docker/certs/ca.cert:/etc/pki/tls/certs/ca.cert:ro
       - ./docker/certs/ca.cert:/etc/pki/ca-trust/source/anchors/ca.cert:ro
       - ./docker/certs/kolab.hosted.com.cert:/etc/pki/tls/certs/kolab.hosted.com.cert
       - ./docker/certs/kolab.hosted.com.key:/etc/pki/tls/certs/kolab.hosted.com.key
       - ./docker/certs/kolab.mgmt.com.cert:/etc/pki/tls/certs/kolab.mgmt.com.cert
       - ./docker/certs/kolab.mgmt.com.key:/etc/pki/tls/certs/kolab.mgmt.com.key
       - ./docker/kolab/utils:/root/utils:ro
       - ./src/.env:/.dockerenv:ro
       - /sys/fs/cgroup:/sys/fs/cgroup:ro
   mariadb:
     container_name: kolab-mariadb
     environment:
       MYSQL_ROOT_PASSWORD: Welcome2KolabSystems
       TZ: "+02:00"
     healthcheck:
       interval: 10s
       test: test -e /var/run/mysqld/mysqld.sock
       timeout: 5s
       retries: 30
     image: mariadb
     network_mode: host
   nginx:
     build:
       context: ./docker/nginx/
       args:
         APP_WEBSITE_DOMAIN: ${APP_WEBSITE_DOMAIN:?err}
     depends_on:
       kolab:
         condition: service_healthy
     healthcheck:
       interval: 10s
       test: "kill -0 $$(cat /run/nginx.pid)"
       timeout: 5s
       retries: 30
     container_name: kolab-nginx
     hostname: nginx.hosted.com
     image: kolab-nginx
     network_mode: host
     tmpfs:
       - /run
       - /tmp
       - /var/run
       - /var/tmp
     tty: true
     volumes:
       - ./docker/certs/imap.hosted.com.cert:/etc/pki/tls/certs/imap.hosted.com.cert
       - ./docker/certs/imap.hosted.com.key:/etc/pki/tls/private/imap.hosted.com.key
   pdns-sql:
     build:
       context: ./docker/pdns-sql/
     container_name: kolab-pdns-sql
     depends_on:
       mariadb:
         condition: service_healthy
     hostname: pdns-sql
     image: apheleia/kolab-pdns-sql
     network_mode: host
     tmpfs:
       - /run
       - /tmp
       - /var/run
       - /var/tmp
     tty: true
     volumes:
       - /sys/fs/cgroup:/sys/fs/cgroup:ro
   proxy:
     build:
       context: ./docker/proxy/
       args:
         APP_WEBSITE_DOMAIN: ${APP_WEBSITE_DOMAIN:?err}
         SSL_CERTIFICATE: /etc/letsencrypt/live/${APP_WEBSITE_DOMAIN:?err}/fullchain.pem
         SSL_CERTIFICATE_KEY: /etc/letsencrypt/live/${APP_WEBSITE_DOMAIN:?err}/privkey.pem
     healthcheck:
       interval: 10s
       test: "kill -0 $$(cat /run/nginx.pid)"
       timeout: 5s
       retries: 30
     container_name: kolab-proxy
     hostname: ${APP_WEBSITE_DOMAIN:?err}
     image: kolab-proxy
     network_mode: host
     tmpfs:
       - /run
       - /tmp
       - /var/run
       - /var/tmp
     tty: true
     volumes:
       - ./docker/certs/:/etc/certs/:ro
       - /etc/letsencrypt/:/etc/letsencrypt/:ro
       - /sys/fs/cgroup:/sys/fs/cgroup:ro
   redis:
     build:
       context: ./docker/redis/
     healthcheck:
       interval: 10s
       test: "redis-cli ping || exit 1"
       timeout: 5s
       retries: 30
     container_name: kolab-redis
     hostname: redis
     image: redis
     network_mode: host
     volumes:
       - ./docker/redis/redis.conf:/usr/local/etc/redis/redis.conf:ro
   swoole:
     build:
       context: ./docker/swoole/
     container_name: kolab-swoole
     image: apheleia/swoole:4.8.x
   webapp:
     build:
       context: ./docker/webapp/
     container_name: kolab-webapp
     image: kolab-webapp
     healthcheck:
       interval: 10s
       test: "/src/kolabsrc/artisan octane:status || exit 1"
       timeout: 5s
       retries: 30
     depends_on:
       kolab:
         condition: service_healthy
     network_mode: host
     volumes:
       - ./src:/src/kolabsrc.orig:ro
   tests:
     build:
       context: ./docker/tests/
     container_name: kolab-tests
     image: kolab-tests
     depends_on:
       kolab:
         condition: service_healthy
     network_mode: host
     volumes:
       - ./src:/src/kolabsrc.orig:ro
   worker:
     build:
       context: ./docker/worker/
     container_name: kolab-worker
     depends_on:
       - kolab
     hostname: worker
     image: kolab-worker
     network_mode: host
     tmpfs:
       - /run
       - /tmp
       - /var/run
       - /var/tmp
     tty: true
     volumes:
       - ./src:/home/worker/src.orig:ro
       - /sys/fs/cgroup:/sys/fs/cgroup:ro
   meet:
     build:
       context: ./docker/meet/
     healthcheck:
       interval: 10s
       test: "curl --insecure -H 'X-AUTH-TOKEN: ${MEET_SERVER_TOKEN}' --fail https://localhost:12443/meetmedia/api/health || exit 1"
       timeout: 5s
       retries: 30
     environment:
       - WEBRTC_LISTEN_IP=${MEET_WEBRTC_LISTEN_IP:?err}
       - PUBLIC_DOMAIN=${MEET_PUBLIC_DOMAIN:?err}
       - LISTENING_HOST=0.0.0.0
       - LISTENING_PORT=12443
       - TURN_SERVER=${MEET_TURN_SERVER}
       - TURN_STATIC_SECRET=${COTURN_STATIC_SECRET}
       - AUTH_TOKEN=${MEET_SERVER_TOKEN:?err}
       - WEBHOOK_TOKEN=${MEET_WEBHOOK_TOKEN:?err}
       - WEBHOOK_URL=${APP_PUBLIC_URL:?err}/api/webhooks/meet
       - SSL_CERT=/etc/pki/tls/certs/meet.${APP_WEBSITE_DOMAIN:?err}.cert
       - SSL_KEY=/etc/pki/tls/private/meet.${APP_WEBSITE_DOMAIN:?err}.key
     network_mode: host
     container_name: kolab-meet
     image: kolab-meet
     volumes:
       - ./meet/server:/src/meet/:ro
       - ./docker/meet/build/node_modules:/root/node_modules
       - ./docker/certs/meet.${APP_WEBSITE_DOMAIN}.cert:/etc/pki/tls/certs/meet.${APP_WEBSITE_DOMAIN}.cert
       - ./docker/certs/meet.${APP_WEBSITE_DOMAIN}.key:/etc/pki/tls/private/meet.${APP_WEBSITE_DOMAIN}.key
diff --git a/docker/kolab/utils/10-change-port-numbers.sh b/docker/kolab/utils/10-change-port-numbers.sh
index b62615fc..e69bdf58 100755
--- a/docker/kolab/utils/10-change-port-numbers.sh
+++ b/docker/kolab/utils/10-change-port-numbers.sh
@@ -1,145 +1,163 @@
 #!/bin/bash
 
+cat ${SSL_CERTIFICATE} ${SSL_CERTIFICATE_FULLCHAIN} ${SSL_CERTIFICATE_KEY} > /etc/pki/cyrus-imapd/cyrus-imapd.bundle.pem
+chown cyrus:mail /etc/pki/cyrus-imapd/cyrus-imapd.bundle.pem
+
+cp /etc/pki/cyrus-imapd/cyrus-imapd.bundle.pem /etc/pki/tls/private/postfix.pem
+chown postfix:mail /etc/pki/tls/private/postfix.pem
+chmod 655 /etc/pki/tls/private/postfix.pem
+
+sed -i "s/tls_server_cert:.*/tls_server_cert: \/etc\/pki\/cyrus-imapd\/cyrus-imapd.bundle.pem/" /etc/imapd.conf
+sed -i "s/tls_server_key:.*/tls_server_key: \/etc\/pki\/cyrus-imapd\/cyrus-imapd.bundle.pem/" /etc/imapd.conf
+sed -i "s/tls_server_ca_file:.*/tls_server_ca_file: \/etc\/pki\/cyrus-imapd\/cyrus-imapd.bundle.pem/" /etc/imapd.conf
+
+sed -i "s/smtpd_tls_key_file =.*/smtpd_tls_key_file = \/etc\/pki\/tls\/private\/postfix.pem/" /etc/postfix/main.cf
+sed -i "s/smtpd_tls_cert_file =.*/smtpd_tls_cert_file = \/etc\/pki\/tls\/private\/postfix.pem/" /etc/postfix/main.cf
+
 sed -i -r \
     -e '/allowplaintext/ a\
 guam_allowplaintext: yes' \
     -e '/allowplaintext/ a\
 nginx_allowplaintext: yes' \
     /etc/imapd.conf
 
 sed -i \
     -e '/SERVICES/ a\
     nginx cmd="imapd" listen=127.0.0.1:12143 prefork=1' \
     -e '/SERVICES/ a\
     guam cmd="imapd" listen=127.0.0.1:13143 prefork=1' \
     -e '/SERVICES/ a\
     imap cmd="imapd" listen=127.0.0.1:11143 prefork=1' \
     -e 's/listen="127.0.0.1:9993"/listen=127.0.0.1:11993/g' \
     /etc/cyrus.conf
 
 systemctl restart cyrus-imapd
 
 # Remove the submission block, by matching from submission until the next empty line
 sed -i -e '/submission          inet/,/^$/d' /etc/postfix/master.cf
 
 # Insert a new submission block with a modified port
 cat >> /etc/postfix/master.cf << EOF
 127.0.0.1:10587     inet        n       -       n       -       -       smtpd
     -o cleanup_service_name=cleanup_submission
     -o syslog_name=postfix/submission
     #-o smtpd_tls_security_level=encrypt
     -o smtpd_sasl_auth_enable=yes
     -o smtpd_sasl_authenticated_header=yes
     -o smtpd_client_restrictions=permit_sasl_authenticated,reject
     -o smtpd_data_restrictions=\$submission_data_restrictions
     -o smtpd_recipient_restrictions=\$submission_recipient_restrictions
     -o smtpd_sender_restrictions=\$submission_sender_restrictions
 
 127.0.0.1:10465     inet        n       -       n       -       -       smtpd
     -o cleanup_service_name=cleanup_submission
     -o rewrite_service_name=rewrite_submission
     -o syslog_name=postfix/smtps
     -o mydestination=
     -o local_recipient_maps=
     -o relay_domains=
     -o relay_recipient_maps=
     #-o smtpd_tls_wrappermode=yes
     -o smtpd_sasl_auth_enable=yes
     -o smtpd_sasl_authenticated_header=yes
     -o smtpd_client_restrictions=permit_sasl_authenticated,reject
     -o smtpd_sender_restrictions=\$submission_sender_restrictions
     -o smtpd_recipient_restrictions=\$submission_recipient_restrictions
     -o smtpd_data_restrictions=\$submission_data_restrictions
 EOF
 
 systemctl restart postfix
 
 cat > /etc/guam/sys.config << EOF
 %% Example configuration for Guam.
 [
     {
         kolab_guam, [
             {
                 imap_servers, [
                     {
                         imap, [
                             { host, "127.0.0.1" },
                             { port, 13143 },
                             { tls, no }
                         ]
                     },
                     {
                         imaps, [
                             { host, "127.0.0.1" },
                             { port, 11993 },
                             { tls, true }
                         ]
                     }
                 ]
             },
             {
                 listeners, [
                     {
                         imap, [
                             { port, 9143 },
                             { imap_server, imap },
                             {
                                 rules, [
                                     { filter_groupware, [] }
                                 ]
                             },
                             {
                                 tls_config, [
-                                    { certfile, "/etc/pki/cyrus-imapd/cyrus-imapd.pem" }
+                                    { certfile, "/etc/pki/cyrus-imapd/cyrus-imapd.bundle.pem" },
+                                    { keyfile, "/etc/pki/cyrus-imapd/cyrus-imapd.bundle.pem" },
+                                    { cacertfile, "/etc/pki/cyrus-imapd/cyrus-imapd.bundle.pem" }
                                 ]
                             }
                         ]
                     },
                     {
                         imaps, [
                             { port, 9993 },
                             { implicit_tls, true },
                             { imap_server, imaps },
                             {
                                 rules, [
                                     { filter_groupware, [] }
                                 ]
                             },
                             {
                                 tls_config, [
-                                    { certfile, "/etc/pki/cyrus-imapd/cyrus-imapd.pem" }
+                                    { certfile, "/etc/pki/cyrus-imapd/cyrus-imapd.bundle.pem" },
+                                    { keyfile, "/etc/pki/cyrus-imapd/cyrus-imapd.bundle.pem" },
+                                    { cacertfile, "/etc/pki/cyrus-imapd/cyrus-imapd.bundle.pem" }
                                 ]
                             }
                         ]
                     }
                 ]
             }
         ]
     },
 
     {
         lager, [
             {
                 handlers, [
                     { lager_console_backend, warning },
                     { lager_file_backend, [ { file, "log/error.log"}, { level, error } ] },
                     { lager_file_backend, [ { file, "log/console.log"}, { level, info } ] }
                 ]
             }
         ]
     },
 
     %% SASL config
     {
         sasl, [
             { sasl_error_logger, { file, "log/sasl-error.log" } },
             { errlog_type, error },
             { error_logger_mf_dir, "log/sasl" },      % Log directory
             { error_logger_mf_maxbytes, 10485760 },   % 10 MB max file size
             { error_logger_mf_maxfiles, 5 }           % 5 files max
         ]
     }
 ].
 EOF
 
 systemctl restart guam