Uknown Identity cert

AlissonSantos95

Hi i’m using nginx proxy mananger to generate SSL all works, sneding e-mails reciving e-mail from within the SOG but when i try to use external like on my nextcloud to use as notifications or on thunderbird i get an error and a unknown certificate or the e-mail could not be sent and the documentation made me mess things up and i hade to redo all, could anyone point me the right direction like, after i donwload the zip with the certificate from the nginx for mail.domain.com, where do i put and how do i say to the mail server look this is the correct cert.

esackbauer

Follow these instructions:
https://docs.mailcow.email/post_installation/firststeps-ssl/#how-to-use-your-own-certificate
Your nginx proxy manager certs are your “own certificates”, you need to copy them to mailcow and restart the 3 services. And that you need to do each time nginx proxy manager gets new/updated certificates.

AlissonSantos95

Thats the thing, i’m downloading cert1.pem, chain1.pem fullchain1.pem privkey.pem, on the docs you passed he asks for key.pem that i don’t have, i’m really lost in this part, and i need to stop the LE serices too so the mail server stop trying to generate new certs?

mendozal

AlissonSantos95 I would think that privkey.pem is key.pem could you try to rename it?

esackbauer

AlissonSantos95 cert1.pem, chain1.pem fullchain1.pem privkey.pem

You never did Lets Encrypt before? Do you know what is in each of those files?

AlissonSantos95

esackbauer i did but never manually, always some painel did all the work like nginx that just do all work to get the SSL.

[unknown] so i don’t need to bring the archive then just copy/past the content, you guys are a hero, gonna test it now

[unknown] [unknown] so i don’t need to bring the archive then just copy/past the content, you guys are a hero, gonna test it now

AlissonSantos95

Yes i can, i will rename, so let me get this right

Bring down docker with docker-compose down
Download Certs from nginx and renameit
Put them at data/assets/ssl/
Turn off LE at Set SKIP_LETS_ENCRYPT=y in “mailcow.conf” and docker-compose up -d

is that correct ?

esackbauer

Yep, but important is that you copy fullchain1.pem to cert.pem on mailcow.
And privkey.pem to key.pem on mailcow.

esackbauer

And next time the certificates gets renewed it will be the same. You need to copy them again, and then restart the 3 containers as per documentation. No need to bring down all of Docker.

I did an Ansible automation for that job, I would recommend you do the same.

AlissonSantos95

noted gonna study about that then, as i finish and test i gonna put the results here

Most apreciated, and awesome, its working now, thank you, if i couldi would send a beer to you two.