Acme auto renew for both ipv4 and ipv6

esackbauer

ULLLUPOLLLLO i should also mention that im using a nginx proxy

Then it is clear, you should disable ACME on mailcow and let the nginx reverse proxy do the job and get ALL certificates for mailcow.
Copy the certificates from reverse proxy to mailcow:
https://docs.mailcow.email/post_installation/firststeps-ssl/#how-to-use-your-own-certificate

ULLLUPOLLLLO

i tried but it seems like it’s not working: 502 Bad Gateway
and i think this is the error since many containers logs have it:
cannot load certificate "/etc/ssl/mail/cert.pem"

esackbauer

Please check once again, if you have really everything configured according to the documentation for reverse proxy:
https://docs.mailcow.email/post_installation/reverse-proxy/r_p/

ULLLUPOLLLLO

yup reverse proxy has been working with no issue for a while

esackbauer

ULLLUPOLLLLO no issue for a while

Until the certificates need to be renewed 😉 So there is your issue 😉

ULLLUPOLLLLO

well what can i do? the nginx configuration is above and i’ve followed the wiki

esackbauer

I have no idea, you need to describe your setup. What kind of nginx? NGM? Running on the same host where mailcow runs? Or separate host?
Is there a firewall in front? with NAT? How do the rules look like, are they different for IPv6 and IPv4?

ULLLUPOLLLLO

nginx version: nginx/1.18.0 (Ubuntu)
running nginx on the same machine
NAT Type: Blocked
External IP: None
External Port: None
there is a firewall with these rules:

Status: active

To                         Action      From
--                         ------      ----
Anywhere                   ALLOW       81.56.26.25
2204                       ALLOW       Anywhere
80                         ALLOW       Anywhere
443                        ALLOW       Anywhere
Anywhere                   ALLOW       178.218.144.138
Anywhere                   ALLOW       178.218.144.203
6379                       ALLOW       Anywhere
9987                       ALLOW       Anywhere
30033                      ALLOW       Anywhere
2027                       ALLOW       Anywhere
10011                      ALLOW       Anywhere
27017                      ALLOW       Anywhere
8087                       ALLOW       Anywhere
25565                      ALLOW       Anywhere
2204 (v6)                  ALLOW       Anywhere (v6)
80 (v6)                    ALLOW       Anywhere (v6)
443 (v6)                   ALLOW       Anywhere (v6)
27017 (v6)                 ALLOW       Anywhere (v6)
6379 (v6)                  ALLOW       Anywhere (v6)
9987 (v6)                  ALLOW       Anywhere (v6)
30033 (v6)                 ALLOW       Anywhere (v6)
10011 (v6)                 ALLOW       Anywhere (v6)
8087 (v6)                  ALLOW       Anywhere (v6)
25565 (v6)                 ALLOW       Anywhere (v6)

esackbauer

Where is this firewall? And what kind is it? On your Ubuntu host? In front of that?
That are not proper firewall rules, showing Src IP, Src Port, Dst IP, Dst Port

ULLLUPOLLLLO

this firewall is on the same machine, its ufw

esackbauer

See the red box:
https://docs.mailcow.email/getstarted/prerequisite-system/#firewall-ports

« Previous Page