TLSA Behind Wireguard

randommouse

After years of wanting to move my mail server to my local network I finally got the job done. By using a VPS and a wireguard tunnel to a VM running on my own network I was able to successfully forward all the required ports and now I’m able to send and receive emails from a server on my own network! My only issue is with SSL and TLSA. Mailcow won’t aquire certs from letsencrypt and won’t generate a TSLA key (1 1 1 connection refused). I set up Nginx Proxy Manager on the local host and was able to pull SSL certs with it and transfer them to mailcow. The persistent issue is the lack of TLSA. Anyone else have this issue and was able to solve it?

randommouse

Still no luck. I think it might have something to do with routing through the wireguard tunnel and NAT not working as expected. It’s strange that everything else seems to be working as far as the web UI and emails are sending and receiving. I’m going to try changing the VPN client endpoint to my router (OPNSense) to see if I have any luck that way. Will come back to update if successful.

aaronsmith

You could try disabling the validations but you’ll risk being rate limited by Lets Encrypt:
https://docs.mailcow.email/post_installation/firststeps-ssl/#additional-domain-names

Scroll down to the “validation errors and how to fix them” section

randommouse

I’ve already tried this. I would not be posting here if i had not, I’m looking for community support as I cannot find the information the usual way (google). What i really don’t understand is why NPM will pull the letsencrypt certs with the only difference being the docker container.

aaronsmith

Checked the logs from the acme-mailcow container to see if there’s any helpful errors?

randommouse

Finally got it, at least the TLSA issue. I followed this guide > https://github.com/chucklessducks/VPS-Wireguard-Nginx-Mailcow/wiki/Getting-Started but modified it with my own IPtables rules (posted here) and moved the client endpoint to my OPNSense router.