Problem with Acme OpenSSL

RudySixOw

Hello,

I migrated my installation using the create cold standby script, everything works except the creation of SSL certificates.
Here is the error I have in the logs:
Certificate /var/lib/acme/my.domain.com/cert.pem missing or changed domains ‘my.domain.com’ - start obtaining
cat: can’t open ‘/etc/ssl/openssl.cnf’: No such file or directory
unable to find ‘distinguished_name’ in config
problems making Certificate Request
140068830038856:error:0E06D06C:configuration file routines:NCONF_get_string:no value:crypto/conf/conf_lib.c:273:group=req name=distinguished_name
Checking resolver…
Resolver OK
Parsing account key…
Parsing CSR…
Traceback (most recent call last):
File “/usr/bin/acme-tiny”, line 8, in <module>
sys.exit(main())
File “/usr/lib/python3.9/site-packages/acme_tiny.py”, line 195, in main
signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca, disable_check=args.disable_check, directory_url=args.directory_url, contact=args.contact, check_port=args.check_port)
File “/usr/lib/python3.9/site-packages/acme_tiny.py”, line 90, in get_crt
out = _cmd([“openssl”, “req”, “-in”, csr, “-noout”, “-text”], err_msg=“Error loading {0}”.format(csr))
File “/usr/lib/python3.9/site-packages/acme_tiny.py”, line 28, in _cmd
raise IOError(“{0}\n{1}”.format(err_msg, err))
OSError: Error loading /var/lib/acme/mail.sixow.com/acme.csr
b’unable to load X509 request\n140264558455624:error:0909006C😛EM routines:get_name:no start line:crypto/pem/pem_lib.c:745:Expecting: CERTIFICATE REQUEST\n’
Failed to obtain certificate /var/lib/acme/my.domain.com/cert.pem for domains ‘my.domain.com’
OK
Sat Dec 18 07:12:43 CET 2021 - Some errors occurred, retrying in 30 minutes…
OK

Do you have an idea ?

lt100

Same problem

cat: can’t open ‘/etc/ssl/openssl.cnf’: No such file or directory
acme-mailcow_1 | unable to find ‘distinguished_name’ in config
acme-mailcow_1 | problems making Certificate Request

and so forth.

Coudl anyone help us please?

helgur

Same problem here, trying to set up mailcow for the first time …

polly

didnt found this post - and then im not alone

as workaround you could create the certificates by your own with
certbot certonly
and
cp /etc/letsencrypt/live/my.domain.tld/fullchain.pem /opt/mailcow-dockerized/data/assets/ssl/cert.pem
cp /etc/letsencrypt/live/my.domain.tld/privkey.pem /opt/mailcow-dockerized/data/assets/ssl/key.pem
disable letsencrypt in mailcow.conf
restart docker
it worked for me at least

RudySixOw

Glad to see that I’m not alone but to be honest I would prefer someone with the solution 🙂

g4rf

Hi there!

Seems like a regression in or with the new acme-mailcow version 1.80. I filed a bug report here: mailcow/mailcow-dockerized4392

As a quick fix you can change the version in the acme-mailcow section in docker-compose.yml to the prior 1.79 version. But I do not suggest it for a production environement, as I don’t know further implications on changing it.

Instead changing only the version number, follow my bug report on GitHub or downgrade your whole mailcow installation.

sweise

Same issue on my fresh installation. Any idea so far?

MAGIC

HI I just rebuilt the image and pushed it again as 1.80. Can you try again?
You may need to do a docker-compose pull; docker-compose up -d

Justman10000

MAGIC

Have this problem too! See here

sweise

Perfect, you fixed it. My mailcow is now working with a verfyed Lets Encrypt certificate. Thanks a lot.

RudySixOw

Good for me too, thanks a lot.

RudySixOw

Sorry but I’m not very good, where should I go to close?

awsumco

Hi,

There still seems to be a problem, from what I can tell the acme.csr file is not being created as it is zero in size, this produces the following error:

acme-mailcow_1 | Parsing account key…
acme-mailcow_1 | Parsing CSR…
acme-mailcow_1 | Traceback (most recent call last):
acme-mailcow_1 | File “/usr/bin/acme-tiny”, line 8, in <module>
acme-mailcow_1 | sys.exit(main())
acme-mailcow_1 | File “/usr/lib/python3.9/site-packages/acme_tiny.py”, line 195, in main
acme-mailcow_1 | signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca, disable_check=args.disable_check, directory_url=args.directory_url, contact=args.contact, check_port=args.check_port)
acme-mailcow_1 | File “/usr/lib/python3.9/site-packages/acme_tiny.py”, line 90, in get_crt
acme-mailcow_1 | out = _cmd([“openssl”, “req”, “-in”, csr, “-noout”, “-text”], err_msg=“Error loading {0}”.format(csr))
acme-mailcow_1 | File “/usr/lib/python3.9/site-packages/acme_tiny.py”, line 28, in _cmd
acme-mailcow_1 | raise IOError(“{0}\n{1}”.format(err_msg, err))
acme-mailcow_1 | OSError: Error loading /var/lib/acme/XXXXXXXX/acme.csr
acme-mailcow_1 | b’unable to load X509 request\n140242805283656:error:0909006C😛EM routines:get_name:no start line:crypto/pem/pem_lib.c:745:Expecting: CERTIFICATE REQUEST\n’

I am using the image mailcow/acme:1.80

awsumco

Please ignore, turns out the acme.key file was a cert, removed it and restarted acme-mailcow.