I’ve moved my mailcow web interface behind a reverse proxy (Nginx Proxy Manager/NPM) and setup a script to copy the *.myhostdomain.com wildcard certificate and key from NPM to mailcow’s nginx. The mail services (smtp, imap. pop, etc) are not proxied.
When using mailcow behind a reverse proxy, how do others deal with managing these 2 different sets of certs and associated TLSA dns hashes?
In my setup:
1) The HTTPS cert is generated via NPM and copied to mailcow-nginx (opt/mailcow-dockerized/data/assets/ssl). This cert only covers the primary “*.myhostdomain.com” domain of the Mailcow UI and not any of the other mail domains my host supports. My “443.tcp.mail” TLSA DNS record for myhostdomain.com presents the hash of the NPM generated certificate.
2) The other mail service ports (23. 465, 587, etc) ports are not proxied by NPM so mailcow presents the certificate that was originally created by mailcow and my “25.tcp.mail” and other mail ports present the hash of the mailcow generated cert. This cert includes my myhostdomain.com subdomains as well as all the other domains I host mail for as SAN dNSName domains.
So, my myhostdomain.com DNS zone TLSA records for port 443 present the hash of the NPM generated cert, and the TLSA records for all my other mail service ports present the hash of the Mailcow generated cert.
With this setup I am able to get successful DANE verification for every individual https and mail port using https://www.huque.com/bin/danecheck
So, my questions:
1) Do I continue using both sets of certs? If so, I’m assuming I’d have to shutdown NPM and “un-proxy” mailcow at least once every 90 days to restart acme-mailcow and allow it to generate new sets of SAN certs from LetsEncrypt for the mail services? Or:
2) Is it possible/reasonable to try to use NPM to reverse proxy all the mail service ports, and if so, where to I copy the NPM renewed LetsEncrypt cert so that all mailcow services use it?
How do any of you pros that care about your DNSSEC & DANE handle this when using reverse proxy for mailcow? (Open to switching from NPM if there’s a better answer, but it would appear to my simple mind that this same problem would apply to Caddy, Traefik, etc?)
Footnote - all the hosted mail domains directly CNAME to my primary mail.myhostdomain.com as the MX (and autodiscover/autoconfig) dns record. None are trying to alias/cname any of the mail service dns records (mail/smtp/imap/auto*) under their own domain name.
Thank you!
Clarification:
“Footnote - all the hosted mail domains directly point (MX, SPF, DMARC, autoconfig./autodiscover.) to my primary mail.myhostdomain.com as dns record….”
Clarification:
“Footnote - all the hosted mail domains directly point (MX, SPF, DMARC, autoconfig./autodiscover.) to my primary mail.myhostdomain.com as dns record….”
Clarification:
“Footnote - all the hosted mail domains directly point (MX, SPF, DMARC, autoconfig./autodiscover.) to my primary mail.myhostdomain.com as dns record….”
Clarification:
“Footnote - all the hosted mail domains directly point (MX, SPF, DMARC, autoconfig./autodiscover.) to my primary mail.myhostdomain.com as dns record….”
Clarification:
“Footnote - all the hosted mail domains on this mailhost directly point (MX, SPF, DMARC, autoconfig./autodiscover.) to my primary mail.myhostdomain.com domain in their dns records….”
Clarification:
“Footnote - all the hosted mail domains on this mailhost directly point (MX, SPF, DMARC, autoconfig./autodiscover.) to my primary mail.myhostdomain.com domain in their dns records….”
.
Sorry for the multiple ^^^. The site kept saying “oops - something went wrong” when trying to reply.