Cannot validate any hostnames Let's Encrypt

sparviero79

Hi everyone. i installed in a fresh machine with ubuntu 22, everything was fine but it’s not getting let’s encrypt certificates. I am attaching the results of the log…
Can you tell me why it fails?

mailcowdockerized-acme-mailcow-1 | Fri Dec 30 01:10:35 CET 2022 - Initializing, please wait... mailcowdockerized-acme-mailcow-1 | Fri Dec 30 01:10:36 CET 2022 - Using existing domain rsa key /var/lib/acme/acme/key.pem mailcowdockerized-acme-mailcow-1 | Fri Dec 30 01:10:36 CET 2022 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem mailcowdockerized-acme-mailcow-1 | Fri Dec 30 01:10:36 CET 2022 - Detecting IP addresses... mailcowdockerized-acme-mailcow-1 | Fri Dec 30 01:10:55 CET 2022 - OK: 37.XXX.XX.XXX, 0000:0000:0000:0000:0000:0000:0000:0000 mailcowdockerized-acme-mailcow-1 | Fri Dec 30 01:10:57 CET 2022 - Found A record for autodiscover.MY-DOMAIN.it: 37.XXX.XX.XXX mailcowdockerized-acme-mailcow-1 | Fri Dec 30 01:10:57 CET 2022 - Confirmed A record with IP 37.XXX.XX.XXX, but HTTP validation failed mailcowdockerized-acme-mailcow-1 | Fri Dec 30 01:10:57 CET 2022 - Found A record for autoconfig.MY-DOMAIN.it: 37.XXX.XX.XXX mailcowdockerized-acme-mailcow-1 | Fri Dec 30 01:10:57 CET 2022 - Confirmed A record with IP 37.XXX.XX.XXX, but HTTP validation failed mailcowdockerized-acme-mailcow-1 | Fri Dec 30 01:10:57 CET 2022 - Found A record for mail.MY-DOMAIN.it: 37.XXX.XX.XXX mailcowdockerized-acme-mailcow-1 | Fri Dec 30 01:10:57 CET 2022 - Confirmed A record with IP 37.XXX.XX.XXX, but HTTP validation failed mailcowdockerized-acme-mailcow-1 | Fri Dec 30 01:10:57 CET 2022 - Cannot validate any hostnames, skipping Let's Encrypt for 1 hour. mailcowdockerized-acme-mailcow-1 | Fri Dec 30 01:10:57 CET 2022 - Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently. mailcowdockerized-acme-mailcow-1 | OK

mlcwuser

Is your mailcow accessible on port 80? If not, the ACME client cannot validate your domain.

sparviero79

mlcwuser It is configured on HTTP port 7080 and HTTPS 7443 on the mailcow configuration file but anyway I also opened 80 and 443 on the router at the time of deployment knowing that it would look for that too. But he still doesn’t get the certificate

mlcwuser

Not sure if it is enough to just open the port. According to the documentation mailcow must be available on port 80 in order for the HTTP acme-client to work. If you can’t do that, because you have other services running on that port, or don’t want to, because of “security by obscurity” reasons, you probably have to use a reverse proxy, respectively an external ACME client: https://docs.mailcow.email/post_installation/firststeps-ssl/

sparviero79

Effectively by editing the mailcow.conf configuration file and entering the HTTP 80 and HTTPS 443 ports and always opening the relevant ports on the router, it obtains the certificates. but since I run Nginx Reverse Proxy on ports 80 and 443, how can I solve the problem of updating the certificates without having to change the settings every 3 months? i.e. is there no way to make it update the certificates on another HTTP port?

mlcwuser

I can’t help with detailed instructions, since I use mailcow on a VPS without reverse proxy, but there’s a section about reverse proxies in the documentation, which also provides an example config for Nginx: https://docs.mailcow.email/post_installation/firststeps-rp/