Failed to obtain certificate, Some errors occurred

kiekar

I decided to do a new install of mailcow. After the installation was completed acme was able to create a new certificate.
I then proceded to restore from my backups. Once restore was completed I viewed the acme logs and noticed I now have error shown below. Not sure why I now have issues after restoring but all was working find before the restore. Not sure on how to fix this. Any ideas how I can fix this.

mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:41 EDT 2023 - Waiting for Docker API... mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:41 EDT 2023 - Docker API OK mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:41 EDT 2023 - Waiting for Postfix... mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:41 EDT 2023 - Postfix OK mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:41 EDT 2023 - Waiting for Dovecot... mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:41 EDT 2023 - Dovecot OK mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:41 EDT 2023 - Waiting for database... mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:41 EDT 2023 - Database OK mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:41 EDT 2023 - Waiting for Nginx... mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:48 EDT 2023 - Nginx OK mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:48 EDT 2023 - Waiting for resolver... mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:51 EDT 2023 - Resolver OK mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:51 EDT 2023 - Waiting for domain table... mailcowdockerized-acme-mailcow-1 | OK mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:04:51 EDT 2023 - Initializing, please wait... mailcowdockerized-acme-mailcow-1 | Could not read certificate from <stdin> mailcowdockerized-acme-mailcow-1 | Unable to load certificate mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:02 EDT 2023 - Using existing domain rsa key /var/lib/acme/acme/key.pem mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:02 EDT 2023 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:05 EDT 2023 - Found A record for autodiscover.mydomain.com: 185.xxx.xxx.xxx mailcowdockerized-acme-mailcow-1 | (skipping check, returning 0) mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:05 EDT 2023 - Confirmed A record 185.xxx.xxx.xxx mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:05 EDT 2023 - Found A record for autoconfig.mydomain.com: 185.xxx.xxx.xxx mailcowdockerized-acme-mailcow-1 | (skipping check, returning 0) mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:05 EDT 2023 - Confirmed A record 185.xxx.xxx.xxx mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:06 EDT 2023 - No A or AAAA record found for hostname autodiscover.domain.com mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:06 EDT 2023 - No A or AAAA record found for hostname autoconfig.domain.com mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:08 EDT 2023 - Found A record for mail.mydomain.com: 69.xxx.xxx.xxx mailcowdockerized-acme-mailcow-1 | (skipping check, returning 0) mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:08 EDT 2023 - Confirmed A record 69.xxx.xxx.xxx mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:08 EDT 2023 - Certificate /var/lib/acme/mail.mydomain.com/cert.pem missing or changed domains 'mail.mydomain.com autoconfig.mydomain.com autodiscover.mydomain.com' - start obtaining mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:08 EDT 2023 - Creating backups in /var/lib/acme/backups/mail.mydomain.com/2023-06-25_11_05_08 ... mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:08 EDT 2023 - Checking resolver... mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:09 EDT 2023 - Resolver OK mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:09 EDT 2023 - Using command acme-tiny --account-key /var/lib/acme/acme/account.pem --disable-check --csr /var/lib/acme/mail.mydomain.com/acme.csr --acme-dir /var/www/acme/ mailcowdockerized-acme-mailcow-1 | Parsing account key... mailcowdockerized-acme-mailcow-1 | Parsing CSR... mailcowdockerized-acme-mailcow-1 | Found domains: mail.mydomain.com, autoconfig.mydomain.com, autodiscover.mydomain.com mailcowdockerized-acme-mailcow-1 | Getting directory... mailcowdockerized-acme-mailcow-1 | Directory found! mailcowdockerized-acme-mailcow-1 | Registering account... mailcowdockerized-acme-mailcow-1 | Already registered! Account ID: https://acme-v02.api.letsencrypt.org/acme/acct/1174695377 mailcowdockerized-acme-mailcow-1 | Creating new order... mailcowdockerized-acme-mailcow-1 | Order created! mailcowdockerized-acme-mailcow-1 | Verifying autodiscover.mydomain.com... mailcowdockerized-acme-mailcow-1 | Traceback (most recent call last): mailcowdockerized-acme-mailcow-1 | File "/usr/bin/acme-tiny", line 8, in <module> mailcowdockerized-acme-mailcow-1 | sys.exit(main()) mailcowdockerized-acme-mailcow-1 | File "/usr/lib/python3.10/site-packages/acme_tiny.py", line 195, in main mailcowdockerized-acme-mailcow-1 | signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca, disable_check=args.disable_check, directory_url=args.directory_url, contact=args.contact, check_port=args.check_port) mailcowdockerized-acme-mailcow-1 | File "/usr/lib/python3.10/site-packages/acme_tiny.py", line 153, in get_crt mailcowdockerized-acme-mailcow-1 | raise ValueError("Challenge did not pass for {0}: {1}".format(domain, authorization)) mailcowdockerized-acme-mailcow-1 | ValueError: Challenge did not pass for autodiscover.mydomain.com: {'identifier': {'type': 'dns', 'value': 'autodiscover.mydomain.com'}, 'status': 'invalid', 'expires': '2023-07-02T14:57:29Z', 'challenges': [{'type': 'http-01', 'status': 'invalid', 'error': {'type': 'urn:ietf:params:acme:error:unauthorized', 'detail': '185.xxx.xxx.xxx: Invalid response from https://autodiscover.mydnsprovider.ca/.well-known/acme-challenge/jHWpijURd6QBET9MpGuQ_xxxxxxxxxxx_xxxxxxxx: 404', 'status': 403}, 'url': 'https://acme-v02.api.letsencrypt.org/acme/chall-v3/239930047387/iXUxfQ', 'token': 'jHWpijURd6QBET9MpGuQ_xxxxxxxxxxx_xxxxxxxx', 'validationRecord': [{'url': 'http://autodiscover.mydomain.com/.well-known/acme challenge/jHWpijURd6QBET9MpGuQ_xxxxxxxxxxx_xxxxxxxx', 'hostname': 'autodiscover.mydomain.com', 'port': '80', 'addressesResolved': ['185.xxx.xxx.xxx'], 'addressUsed': '185.xxx.xxx.xxx'}, {'url': 'https://autodiscover.mydnsprovider.ca/.well-known/acme-challenge/jHWpijURd6QBET9MpGuQ_xxxxxxxxxxx_xxxxxxxx', 'hostname': 'autodiscover.mydnsprovider.ca', 'port': '443', 'addressesResolved': ['64.xx.xxx.xx'], 'addressUsed': '64.xx.xxx.xx'}], 'validated': '2023-06-25T15:05:16Z'}]} mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:19 EDT 2023 - Failed to obtain certificate /var/lib/acme/mail.mydomain.com/cert.pem for domains 'mail.mydomain.com autoconfig.mydomain.com autodiscover.mydomain.com' mailcowdockerized-acme-mailcow-1 | OK mailcowdockerized-acme-mailcow-1 | Sun Jun 25 11:05:19 EDT 2023 - Some errors occurred, retrying in 30 minutes... mailcowdockerized-acme-mailcow-1 | OK
Thanks

jiapei100

kiekar

Same issue here, please refer to: https://github.com/mailcow/mailcow-dockerized/issues/2087#issuecomment-1606173007 .

kiekar

jiapei100

Thanks for pointing me in the right direction. I was able to resolve my issue. I was using a service (Mailmaps) from my DNS povider which is an inbound email forwarding feature. I forgot to deactivate it after my mail server came back online. That is why I was recieving the error below.

error': {'type': 'urn:ietf:params:acme:error:unauthorized', 'detail': '185.xxx.xxx.xxx: Invalid response from https://autodiscover.mydnsprovider.ca/.well-known/acme-challenge/jHWpijURd6QBET9MpGuQ_xxxxxxxxxxx_xxxxxxxx: 404', 'status': 403}
Thanks