Mailcow + Traefik -> CertCheck error

harry-uhlbach

I am using Mailcow in combination with traefik. The Important lines of my setup for my questions are:

  nginx-mailcow:
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      - "traefik.http.routers.mail.rule=Host(`mail.amani-kinderdorf.de`)"
      - "traefik.http.routers.mail.entrypoints=https"
      - "traefik.http.routers.mail.tls=true"
      - "traefik.http.routers.mail.tls.certresolver=letsencrypt"
      - "traefik.http.routers.mail.middlewares=secHeaders@file"
      - "traefik.http.services.mail.loadbalancer.server.port=6680"
      - "traefik.http.routers.mailcow.entrypoints=http"
      - "traefik.http.routers.mailcow.rule=HostRegexp(`{host:(autodiscover|autoconfig|webmail|mail|email).+}`)"
    networks:
      - web

  certdumper:
    image: humenius/traefik-certs-dumper
    container_name: traefik_certdumper
    network_mode: none
    command: --restart-containers mailcowdockerized_postfix-mailcow_1,mailcowdockerized_dovecot-mailcow_1
    volumes:
      - /srv/docker/traefik:/traefik:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/assets/ssl:/output:rw
    environment:
      - DOMAIN=amani-kinderdorf.de

With this the automatically generated certificates are stored into data/assets/ssl. I then restart mailcowdockerized_postfix-mailcow_1 and mailcowdockerized_dovecot-mailcow_1
I think this is all I need to do. This setup works wonderfull, but I keep getting Mails, that my certificates are about to expire with the Subject Watchdog ALERT: certcheck and the following contentn which repeats itself multiple times:

SSL OK - Certificate 'www.amani-kinderdorf.de' will expire in 48 days on 2023-01-20 02:06 +0100/CET.
SSL CRITICAL - Certificate 'www.amani-kinderdorf.de' expired on 2022-11-20 21:01 +0100/CET.
SSL OK - Certificate 'www.amani-kinderdorf.de' will expire in 48 days on 2023-01-20 02:06 +0100/CET.
SSL CRITICAL - Certificate 'www.amani-kinderdorf.de' expired on 2022-11-20 21:01 +0100/CET.
SSL OK - Certificate 'www.amani-kinderdorf.de' will expire in 48 days on 2023-01-20 02:06 +0100/CET.
SSL CRITICAL - Certificate 'www.amani-kinderdorf.de' expired on 2022-11-20 21:01 +0100/CET.
SSL OK - Certificate 'www.amani-kinderdorf.de' will expire in 48 days on 2023-01-20 02:06 +0100/CET.
SSL CRITICAL - Certificate 'www.amani-kinderdorf.de' expired on 2022-11-20 21:01 +0100/CET.
...

This Mail starts to come up after about i guess 60 days of constantly running mailcow. After a restart it is gone. So what am I missing? Is there another service that needs restart? Is the one line related to SMTP and the other to IMAP?
Thanks in advance for your help and answers.

D4niel

If you’re not generating the certificates through mailcow you’d probably want to enable SKIP_LETS_ENCRYPT in the mailcow config.

harry-uhlbach

D4niel SKIP_LETS_ENCRYPT=y is set in my mailcow.conf.

D4niel

Is the acme container still running? I just stopped it and commented out restart: always in the compose file.

accolon

The acme container is running even when SKIP_LETS_ENCRYPT is set, it simply runs a sleep command then, see:
https://github.com/mailcow/mailcow-dockerized/blob/10b1be7f6b5e1f8cbe477b35b5601755db0717e2/data/Dockerfiles/acme/acme.sh#L43

I’m only doing guesswork here since I let mailcow handle the certificates. As far as I can see, the check for valid certificates doesn’t depend on the acme container and is always run. It is done here:
https://github.com/mailcow/mailcow-dockerized/blob/77281629b9ad7d01c0002476ce91d0363b5ff6d9/data/Dockerfiles/watchdog/watchdog.sh#L501

There are two checks (lines 512 and 513), one for SMTP and one for IMAP. Both require the certificate to be valid for at least 7 days (-D 7).

Are your certificates renewed less than 7 days before they expire?

harry-uhlbach

accolon I am very certain it does, if you want to double check please have a look yourself at the server: https://mail.amani-kinderdorf.de/

accolon

After looking at the error messages again, I realized that they are referring to www.amani-kinderdorf.de, not to the mail subdomain.

mailcow’s acme container also restarts the nginx container after renewing certificates, you don’t do this.

What I don’t understand (yet) is why mailcow’s watchdog even checks the www domain. I suppose this is an independent web server and not part of your mailcow installation.

harry-uhlbach

accolon I added the nginx to restart as well. Lets see in 60 days what will happen…