having trouble with letsencrypt/acme

nsumner

I get the following in my log

acme-mailcow-1 | Tue Feb 27 15:45:24 IST 2024 - Initializing, please wait…
acme-mailcow-1 | Tue Feb 27 15:45:24 IST 2024 - Using existing domain rsa key /var/lib/acme/acme/key.pem
acme-mailcow-1 | Tue Feb 27 15:45:24 IST 2024 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem
acme-mailcow-1 | Tue Feb 27 15:45:24 IST 2024 - Detecting IP addresses…
acme-mailcow-1 | Tue Feb 27 15:46:03 IST 2024 - OK: 185.241.4.45, 0000:0000:0000:0000:0000:0000:0000:0000
acme-mailcow-1 | Tue Feb 27 15:46:11 IST 2024 - Validated CAA for parent domain citybook.services
acme-mailcow-1 | Tue Feb 27 15:46:11 IST 2024 - No A or AAAA record found for hostname mail.domain.services
acme-mailcow-1 | Tue Feb 27 15:46:11 IST 2024 - Cannot validate any hostnames, skipping Let’s Encrypt for 1 hour.
acme-mailcow-1 | Tue Feb 27 15:46:11 IST 2024 - Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently.
acme-mailcow-1 | OK

I didn’t setup autodiscover etc. But I assume that should be fine. I did change the domain.

Here is a DIG (changing the domain and IP but whatever)

; <<>> DiG 9.18.18-0ubuntu0.22.04.2-Ubuntu <<>> mail.citybook.services
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40959
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;mail.citybook.services. IN A

;; ANSWER SECTION:
mail.domain.services. 60 IN A 185.251.4.57

;; Query time: 56 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Tue Feb 27 15:54:11 IST 2024
;; MSG SIZE rcvd: 67

esackbauer

nsumner I didn’t setup autodiscover etc. But I assume that should be fine.

No, that is not fine. Please read the requirements:
https://docs.mailcow.email/getstarted/prerequisite-dns/

Also: mail.citybook.services points to 185.241.4.45, while “mail.domain.services” points to 185.251.4.57?
Now, what are the correct FQDNs and what are the correct IPs?

nsumner

esackbauer

I mucked up and didn’t delete the first mail.citybook.services. That is the domain and the IP it has is the correct IP… I was sloppy in trying to remove the actual domain (but did change the IP:-)).

I’m checking that guide now.

So since I haven’t added a domain yet the only thing that should be needed is an A record for mail.citybook.services which exists!

The MX record also exists.

AND to top it off reverse DNS exists.

So I go back to not knowing why it is having a problem. The complaint is very specific that there is no A record for mail.citybook.services but there is. Not just does my DNS host show it but even from the server doing a DIG (to 8.8.8.8, and I have done to 1.1.1.1) shows it exists!

C:\Users\nsumn>dig @1.1.1.1 mail.citybook.services A +short
185.241.4.45

C:\Users\nsumn>dig @8.8.8.8 mail.citybook.services A +short
185.241.4.45

C:\Users\nsumn>dig @8.8.8.8 -x 185.241.4.45 +short
mail.citybook.services.

C:\Users\nsumn>dig @1.1.1.1 citybook.services MX +short
10 mail.citybook.services.

Again I still need to add the domain so I doubt even the MX matters. I seem to have all the DNS entries in place from what I can tell.

esackbauer

Please do the dig commands from inside the acme container. Maybe you have an issue with your firewall, you should allow Port 53 TCP and UDP outbound. The unbound (DNS) container uses the root hints.

nsumner

Okay, I am not yet blocking anything (yet) on a firewall level.

root@mail:/opt/mailcow-dockerized# docker exec -it mailcowdockerized-acme-mailcow-1 bash
78031a8b8674:/# dig mail.citybook.services A +short
185.241.4.45
78031a8b8674:/#

Which is exactly what I expect of course. I have the autodiscover and autoconfigure there as well. I will try to add the domain just for the sake of it.

Okay that is strange. I just went back to the admin panel and at some point with no change on my side it got the certificate!?!?

I guess all is well that ends well.

maddler

was that a new record? Perhaps?