Ich versuche gerade meiner Mailcow mit mehreren Domains das Zertifikat auszustellen. Möglicherweise scheitere ich an den diversen unterschiedlichen Bezeichnungen für API KEY TOKEN usw.. Alle Domains sind in einem Account bei Cloudflare registriert und über einen Token erreichbar. Ich habe den Token verwendet, welchen ich als “DNS Token” gespeichert habe, als Account habe ich die dazugehörige Mailadress verwendet,

Inhalt von /opt/mailcow-dockerized/data/conf/acme/dns-01.conf
CF_Token=“xxxxxxyyyyyyyyy”
CF_Account_ID=“adresse@domain.tld”

Inhalt von mailcow.conf
SKIP_LETS_ENCRYPT=n
#ACME_CA=https://acme-v02.api.letsencrypt.org/directory
ACME_VALIDATOR=dns
ACME_DNS_CHALLENGE=y
ACME_DNS_PROVIDER=dns_cf
ACME_ACCOUNT_EMAIL=adresse@domain.tld

Trotzdem sehe ich den Fehler gerade nicht …. habe wohl schon zuviel rumprobiert …

Danke für Hilfe
René

Mein Output ist folgender:
acme-mailcow-1 | Thu Mar 19 14:51:21 CET 2026 - Using existing domain rsa key /var/lib/acme/acme/key.pem
acme-mailcow-1 | Thu Mar 19 14:51:21 CET 2026 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem
acme-mailcow-1 | Thu Mar 19 14:51:21 CET 2026 - Detecting IP addresses…
acme-mailcow-1 | Thu Mar 19 14:51:30 CET 2026 - OK: 1.2.3.4, 0000:0000:0000:0000:0000:0000:0000:0000
acme-mailcow-1 | Thu Mar 19 14:51:30 CET 2026 - Validated CAA for parent domain domain1.tld
acme-mailcow-1 | Thu Mar 19 14:51:30 CET 2026 - Found A record for autodiscover.domain1.tld: 1.2.3.4
acme-mailcow-1 | (skipping check, returning 0)
acme-mailcow-1 | Thu Mar 19 14:51:30 CET 2026 - Confirmed A record 1.2.3.4
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Validated CAA for parent domain domain1.tld
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Found A record for autoconfig.domain1.tld: 1.2.3.4
acme-mailcow-1 | (skipping check, returning 0)
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Confirmed A record 1.2.3.4
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Validated CAA for parent domain domain1.tld
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Found A record for mta-sts.domain1.tld: 1.2.3.4
acme-mailcow-1 | (skipping check, returning 0)
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Confirmed A record 1.2.3.4
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Validated CAA for parent domain domain2.tld
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Found A record for autodiscover.domain2.tld: 1.2.3.4
acme-mailcow-1 | (skipping check, returning 0)
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Confirmed A record 1.2.3.4
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Validated CAA for parent domain domain2.tld
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Found A record for autoconfig.domain2.tld: 1.2.3.4
acme-mailcow-1 | (skipping check, returning 0)
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Confirmed A record 1.2.3.4
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Validated CAA for parent domain domain2.tld
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Found A record for mta-sts.domain2.tld: 1.2.3.4
acme-mailcow-1 | (skipping check, returning 0)
acme-mailcow-1 | Thu Mar 19 14:51:31 CET 2026 - Confirmed A record 1.2.3.4
acme-mailcow-1 | Thu Mar 19 14:51:32 CET 2026 - Validated CAA for parent domain domain3.tld
acme-mailcow-1 | Thu Mar 19 14:51:32 CET 2026 - Found A record for autodiscover.domain3.tld: 1.2.3.4
acme-mailcow-1 | (skipping check, returning 0)
acme-mailcow-1 | Thu Mar 19 14:51:32 CET 2026 - Confirmed A record 1.2.3.4
acme-mailcow-1 | Thu Mar 19 14:51:32 CET 2026 - Validated CAA for parent domain domain3.tld
acme-mailcow-1 | Thu Mar 19 14:51:32 CET 2026 - Found A record for autoconfig.domain3.tld: 1.2.3.4
acme-mailcow-1 | (skipping check, returning 0)
acme-mailcow-1 | Thu Mar 19 14:51:32 CET 2026 - Confirmed A record 1.2.3.4
acme-mailcow-1 | Thu Mar 19 14:51:32 CET 2026 - Validated CAA for parent domain domain3.tld
acme-mailcow-1 | Thu Mar 19 14:51:32 CET 2026 - Found A record for mta-sts.domain3.tld: 1.2.3.4
acme-mailcow-1 | (skipping check, returning 0)
acme-mailcow-1 | Thu Mar 19 14:51:32 CET 2026 - Confirmed A record 1.2.3.4
acme-mailcow-1 | Thu Mar 19 14:51:33 CET 2026 - Validated CAA for parent domain domain0.tld
acme-mailcow-1 | Thu Mar 19 14:51:33 CET 2026 - Found A record for mailcow.domain0.tld: 1.2.3.4
acme-mailcow-1 | (skipping check, returning 0)
acme-mailcow-1 | Thu Mar 19 14:51:33 CET 2026 - Confirmed A record 1.2.3.4
acme-mailcow-1 | Thu Mar 19 14:51:33 CET 2026 - Validated CAA for parent domain domain0.tld of mc01.domain0.tld
acme-mailcow-1 | Thu Mar 19 14:51:33 CET 2026 - Validated CAA for parent domain domain0.tld
acme-mailcow-1 | Thu Mar 19 14:51:33 CET 2026 - Found A record for mc01.domain0.tld: 1.2.3.4
acme-mailcow-1 | (skipping check, returning 0)
acme-mailcow-1 | Thu Mar 19 14:51:33 CET 2026 - Confirmed A record 1.2.3.4
acme-mailcow-1 | Thu Mar 19 14:51:33 CET 2026 - Certificate /var/lib/acme/mailcow.domain0.tld/cert.pem missing or changed domains ‘mailcow.domain0.tld autoconfig.domain1.tld autoconfig.domain2.tld autoconfig.domain3.tld autodiscover.domain1.tld autodiscover.domain2.tld autodiscover.domain3.tld mc01.domain0.tld mta-sts.domain1.tld mta-sts.domain2.tld mta-sts.domain3.tld’ - start obtaining
acme-mailcow-1 | Thu Mar 19 14:51:33 CET 2026 - Checking resolver…
acme-mailcow-1 | Thu Mar 19 14:51:33 CET 2026 - Resolver OK
acme-mailcow-1 | Thu Mar 19 14:51:33 CET 2026 - Using command acme-tiny –account-key /var/lib/acme/acme/account.pem –disable-check –csr /var/lib/acme/mailcow.domain0.tld/acme.csr –acme-dir /var/www/acme/
acme-mailcow-1 | Parsing account key…
acme-mailcow-1 | Parsing CSR…
acme-mailcow-1 | Found domains: mta-sts.domain2.tld, mta-sts.domain1.tld, mc01.domain0.tld, autodiscover.domain2.tld, mailcow.domain0.tld, autodiscover.domain1.tld, autoconfig.domain3.tld, autoconfig.domain2.tld, autodiscover.domain3.tld, autoconfig.domain1.tld, mta-sts.domain3.tld
acme-mailcow-1 | Getting directory…
acme-mailcow-1 | Directory found!
acme-mailcow-1 | Registering account…
acme-mailcow-1 | Already registered! Account ID: https://acme-v02.api.letsencrypt.org/acme/acct/12345678
acme-mailcow-1 | Creating new order…
acme-mailcow-1 | Order created!
acme-mailcow-1 | Verifying autoconfig.domain1.tld…
acme-mailcow-1 | Traceback (most recent call last):
acme-mailcow-1 | File “/usr/bin/acme-tiny”, line 8, in <module>
acme-mailcow-1 | sys.exit(main())
acme-mailcow-1 | ^^^^^^
acme-mailcow-1 | File “/usr/lib/python3.12/site-packages/acme_tiny.py”, line 195, in main
acme-mailcow-1 | signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca, disable_check=args.disable_check, directory_url=args.directory_url, contact=args.contact, check_port=args.check_port)
acme-mailcow-1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
acme-mailcow-1 | File “/usr/lib/python3.12/site-packages/acme_tiny.py”, line 153, in get_crt
acme-mailcow-1 | raise ValueError(“Challenge did not pass for {0}: {1}”.format(domain, authorization))
acme-mailcow-1 | ValueError: Challenge did not pass for autoconfig.domain1.tld: {‘identifier’: {‘type’: ‘dns’, ‘value’: ‘autoconfig.domain1.tld’}, ‘status’: ‘invalid’, ‘expires’: ‘2026-03-26T13:51:36Z’, ‘challenges’: [{‘type’: ‘http-01’, ‘url’: ‘https://acme-v02.api.letsencrypt.org/acme/chall/12345678/901234567/_PaY2g’, ‘status’: ‘invalid’, ‘validated’: ‘2026-03-19T13:51:39Z’, ‘error’: {‘type’: ‘urn:ietf:params:acme:error:unauthorized’, ‘detail’: ‘1.2.3.4: Invalid response from http://autoconfig.domain1.tld/.well-known/acme-challenge/Otjb56i7yBbQEJ3sUB3BmqTYDEvX54wqPLxovROOT34: 503’, ‘status’: 403}, ‘token’: ‘Otjb56i7yBbQEJ3sUB3BmqTYDEvX54wqPLxovROOT34’, ‘validationRecord’: [{‘url’: ‘http://autoconfig.domain1.tld/.well-known/acme-challenge/Otjb56i7yBbQEJ3sUB3BmqTYDEvX54wqPLxovROOT34’, ‘hostname’: ‘autoconfig.domain1.tld’, ‘port’: ‘80’, ‘addressesResolved’: [‘1.2.3.4’], ‘addressUsed’: ‘1.2.3.4’}]}]}
acme-mailcow-1 | Thu Mar 19 14:51:40 CET 2026 - Failed to obtain certificate /var/lib/acme/mailcow.domain0.tld/cert.pem for domains ‘mailcow.domain0.tld autoconfig.domain1.tld autoconfig.domain2.tld autoconfig.domain3.tld autodiscover.domain1.tld autodiscover.domain2.tld autodiscover.domain3.tld mc01.domain0.tld mta-sts.domain1.tld mta-sts.domain2.tld mta-sts.domain3.tld’