Hello i wanted to ask if there is a way to configure acme to renew both certificates of ipv4 and ipv6, on my current setup acme skips ipv4 since ipv6 is found, thanks in advance.

Certificates are issued for domain names. This has nothing to do with IPv4 or IPv6.

i had to temporaly remove my aaaa record for the certificate to regenerate it wasn't working without it it skipped the regeneration so there something wrong then

This probably means that you have a misconfiguration for IPv6. [Searching for "acme"](https://community.mailcow.email/?q=acme) here shows many people with similar problems due to different reasons. But without logs from your acme container, one can only guess...

``` 25/05/2024, 00:17:56 mail.ilarity.net - Initializing, please wait... 25/05/2024, 00:17:56 mail.ilarity.net - Using existing domain rsa key /var/lib/acme/acme/key.pem 25/05/2024, 00:17:56 mail.ilarity.net - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem 25/05/2024, 00:17:56 mail.ilarity.net - Detecting IP addresses... 25/05/2024, 00:17:56 mail.ilarity.net - OK: 152.89.254.97, 2a0e:b107:dd0::3:4328:a1a0 25/05/2024, 00:17:56 mail.ilarity.net - Found AAAA record for autodiscover.ilarity.net: 2a0e:b107:dd0::3:4328:a1a0 - skipping A record check 25/05/2024, 00:17:56 mail.ilarity.net - Confirmed AAAA record with IP 2a0e:b107:0dd0:0000:0000:0003:4328:a1a0, but HTTP validation failed 25/05/2024, 00:17:57 mail.ilarity.net - Found AAAA record for autoconfig.ilarity.net: 2a0e:b107:dd0::3:4328:a1a0 - skipping A record check 25/05/2024, 00:17:57 mail.ilarity.net - Confirmed AAAA record with IP 2a0e:b107:0dd0:0000:0000:0003:4328:a1a0, but HTTP validation failed 25/05/2024, 00:17:57 mail.ilarity.net - Found AAAA record for mail.ilarity.net: 2a0e:b107:dd0::3:4328:a1a0 - skipping A record check 25/05/2024, 00:17:57 mail.ilarity.net - Confirmed AAAA record with IP 2a0e:b107:0dd0:0000:0000:0003:4328:a1a0, but HTTP validation failed 25/05/2024, 00:17:57 mail.ilarity.net - Cannot validate any hostnames, skipping Let's Encrypt for 1 hour. 25/05/2024, 00:17:57 mail.ilarity.net - Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently. ```

You need to open the firewall on port 80 for IPv6 also.

80 (v6) ALLOW Anywhere (v6) already on

That is incoming, right? Did you check if mailcows nginx container properly binds to this IPv6 address for port 80 on the host?

`172.22.1.3 - - [26/May/2024:15:07:32 +0100] "HEAD / HTTP/1.1" 200 0 "-" "curl/8.5.0" 2024/05/26 15:07:32 [error] 24#24: *2 connect() failed (111: Connection refused) while connecting to upstream, client: 81.56.26.25, server: mail.ilarity.net, request: "GET /api/v1/get/status/host HTTP/1.0", upstream: "fastcgi://172.22.1.6:9002", host: "mail.ilarity.net", referrer: "https://mail.ilarity.net/" 2024/05/26 15:07:32 [error] 24#24: *2 connect() failed (111: Connection refused) while connecting to upstream, client: 81.56.26.25, server: mail.ilarity.net, request: "GET /api/v1/get/status/host HTTP/1.0", upstream: "fastcgi://[fd4d:6169:6c63:6f77::9]:9002", host: "mail.ilarity.net", referrer: "https://mail.ilarity.net/" 81.56.26.25 - - [26/May/2024:15:07:32 +0100] "GET /api/v1/get/status/host HTTP/1.0" 502 2015 "https://mail.ilarity.net/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" 172.22.1.11 - - [26/May/2024:15:07:37 +0100] "HEAD /settings.php HTTP/1.1" 304 0 "-" "rspamd-3.7.5" fd4d:6169:6c63:6f77::f - - [26/May/2024:15:07:37 +0100] "HEAD /forwardinghosts.php HTTP/1.1" 200 0 "-" "rspamd-3.7.5" 172.22.1.11 - - [26/May/2024:15:07:37 +0100] "GET /forwardinghosts.php HTTP/1.1" 200 85 "-" "rspamd-3.7.5" 172.22.1.10 - - [26/May/2024:15:08:00 +0100] "GET / HTTP/1.1" 200 15 "-" "check_http/v (nagios-plugins 2.4.5)" 172.22.1.11 - - [26/May/2024:15:08:09 +0100] "HEAD /settings.php HTTP/1.1" 304 0 "-" "rspamd-3.7.5" 148.153.56.86 - - [26/May/2024:15:08:10 +0100] "GET /kAhH HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0" 148.153.56.86 - - [26/May/2024:15:08:10 +0100] "GET /AVpV HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0" 148.153.56.86 - - [26/May/2024:15:08:11 +0100] "GET /aab8 HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0" 148.153.56.86 - - [26/May/2024:15:08:11 +0100] "GET /jquery-3.3.1.slim.min.js HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0" 148.153.56.86 - - [26/May/2024:15:08:12 +0100] "GET /aab9 HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0" 148.153.56.86 - - [26/May/2024:15:08:12 +0100] "GET /jquery-3.3.2.slim.min.js HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0" 172.22.1.11 - - [26/May/2024:15:08:25 +0100] "HEAD /forwardinghosts.php HTTP/1.1" 200 0 "-" "rspamd-3.7.5" 172.22.1.11 - - [26/May/2024:15:08:25 +0100] "GET /forwardinghosts.php HTTP/1.1" 200 85 "-" "rspamd-3.7.5" 2024/05/26 15:08:30 [notice] 28#28: http file cache: /tmp 0.000M, bsize: 4096 2024/05/26 15:08:30 [notice] 1#1: signal 17 (SIGCHLD) received from 28 2024/05/26 15:08:30 [notice] 1#1: cache loader process 28 exited with code 0 2024/05/26 15:08:30 [notice] 1#1: signal 29 (SIGIO) received 172.22.1.11 - - [26/May/2024:15:09:05 +0100] "HEAD /settings.php HTTP/1.1" 304 0 "-" "rspamd-3.7.5" 172.22.1.10 - - [26/May/2024:15:09:05 +0100] "GET / HTTP/1.1" 200 15 "-" "check_http/v (nagios-plugins 2.4.5)" fd4d:6169:6c63:6f77::f - - [26/May/2024:15:09:19 +0100] "HEAD /forwardinghosts.php HTTP/1.1" 200 0 "-" "rspamd-3.7.5" 172.22.1.11 - - [26/May/2024:15:09:19 +0100] "GET /forwardinghosts.php HTTP/1.1" 200 85 "-" "rspamd-3.7.5"` i should also mention that im using a nginx proxy here is my config if it helps: ``` server { allow 81.56.26.25; deny all; } server { if ($host = mail.ilarity.net) { return 301 https://$host$request_uri; } # managed by Certbot listen 80; server_name mail.ilarity.net; return 301 https://$host$request_uri; access_log /var/log/nginx/mail/access.log; error_log /var/log/nginx/mail/error.log; } server { listen 443 ssl http2; server_name mail.ilarity.net; ssl_certificate /etc/letsencrypt/live/mail.ilarity.net-0001/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/mail.ilarity.net-0001/privkey.pem; # managed by Certbot ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; ssl_session_tickets off; # See https://ssl-config.mozilla.org/#server=nginx for the latest ssl settings recommendations # An example config is given below ssl_protocols TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA; ssl_prefer_server_ciphers off; location /Microsoft-Server-ActiveSync { proxy_pass http://127.0.0.1:8080/Microsoft-Server-ActiveSync; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_connect_timeout 75; proxy_send_timeout 3650; proxy_read_timeout 3650; proxy_buffers 64 512k; # Needed since the 2022-04 Update for SOGo client_body_buffer_size 512k; client_max_body_size 0; } location / { proxy_pass http://127.0.0.1:8080/; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; client_max_body_size 0; # The following Proxy Buffers has to be set if you want to use SOGo after the 2022-04 (April 2022) Update # Otherwise a Login will fail like this: https://github.com/mailcow/mailcow-dockerized/issues/4537 proxy_buffer_size 128k; proxy_buffers 64 512k; proxy_busy_buffers_size 512k; } } ```

> @"ULLLUPOLLLLO"#p16027 i should also mention that im using a nginx proxy Then it is clear, you should disable ACME on mailcow and let the nginx reverse proxy do the job and get ALL certificates for mailcow. Copy the certificates from reverse proxy to mailcow: https://docs.mailcow.email/post_installation/firststeps-ssl/#how-to-use-your-own-certificate

i tried but it seems like it's not working: 502 Bad Gateway and i think this is the error since many containers logs have it: `cannot load certificate "/etc/ssl/mail/cert.pem"`

mailcow community

Loading...

Something went wrong while trying to load the full version of this site. Try hard-refreshing this page to fix the error.

Acme auto renew for both ipv4 and ipv6

« Previous Page