Random failure to obtain certificates (No A or AAAA record found for hostname)

Faster_Than_Light

I’m encountering intermittent errors when mailcow/acme attempts to renew certificates.

It seems to be completely random, and is solved most of the time by restarting the acme container, but I can’t always access the server, and it prevents my mail clients from working (and my phone blowing up with notifications).

Does anyone have any ideas why that would happen? I’d understand if there was an ongoing issue, but it’ll find A records for some domains, and not others, and it won’t be consistent. It’ll find them for domainA, and not for domainB today, and then tomorrow, it’ll do the opposite. It’s super annoying.

esackbauer

Logs would be helpful, otherwise its only guessing…

Faster_Than_Light

esackbauer I can provide them, but the only useful bit I could see was the failure to find A or AAAA records…


### ALL CERTIFICATES WERE ISSUED CORRECTLY HERE ###

Thu Jul 11 14:56:06 UTC 2024 - Certificates were successfully renewed where required, sleeping for another day.

Fri Jul 12 14:56:06 UTC 2024 - Using existing domain rsa key /var/lib/acme/acme/key.pem
Fri Jul 12 14:56:06 UTC 2024 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem
Fri Jul 12 14:56:12 UTC 2024 - No A or AAAA record found for hostname mail.domain-01.com
Fri Jul 12 14:56:12 UTC 2024 - Found A record for autodiscover.domain-01.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 14:56:12 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 14:56:12 UTC 2024 - Found A record for autoconfig.domain-01.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 14:56:12 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 14:56:15 UTC 2024 - Found A record for mail.domain-02.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 14:56:15 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 14:56:15 UTC 2024 - Found A record for autodiscover.domain-02.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 14:56:15 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 14:56:16 UTC 2024 - Found A record for autoconfig.domain-02.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 14:56:16 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 14:56:18 UTC 2024 - Found A record for autodiscover.domain-00.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 14:56:18 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 14:56:18 UTC 2024 - Found A record for autoconfig.domain-00.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 14:56:18 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 14:56:18 UTC 2024 - Found A record for mail.domain-00.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 14:56:18 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 14:56:18 UTC 2024 - Certificate /var/lib/acme/mail.domain-00.com/cert.pem missing or changed domains 'mail.domain-00.com autoconfig.domain-01.com autoconfig.domain-02.com autoconfig.domain-00.com autodiscover.domain-01.com autodiscover.domain-02.com autodiscover.domain-00.com mail.domain-02.com' - start obtaining
Fri Jul 12 14:56:18 UTC 2024 - Creating backups in /var/lib/acme/backups/mail.domain-00.com/2024-07-12_14_56_18 ...
Fri Jul 12 14:56:18 UTC 2024 - Checking resolver...
Fri Jul 12 14:56:19 UTC 2024 - Resolver OK
Fri Jul 12 14:56:19 UTC 2024 - Using command acme-tiny   --account-key /var/lib/acme/acme/account.pem --disable-check --csr /var/lib/acme/mail.domain-00.com/acme.csr --acme-dir /var/www/acme/
Parsing account key...
Parsing CSR...
Found domains: autoconfig.domain-02.com, mail.domain-02.com, autoconfig.domain-01.com, autoconfig.domain-00.com, mail.domain-00.com, autodiscover.domain-01.com, autodiscover.domain-02.com, autodiscover.domain-00.com
Getting directory...
Directory found!
Registering account...
Already registered! Account ID: https://acme-v02.api.letsencrypt.org/acme/acct/<SNIP>
Creating new order...
Order created!
Already verified: autoconfig.domain-01.com, skipping...
Already verified: autoconfig.domain-02.com, skipping...
Already verified: autoconfig.domain-00.com, skipping...
Already verified: autodiscover.domain-01.com, skipping...
Already verified: autodiscover.domain-02.com, skipping...
Already verified: autodiscover.domain-00.com, skipping...
Already verified: mail.domain-02.com, skipping...
Already verified: mail.domain-00.com, skipping...
Signing certificate...
Certificate signed!
Fri Jul 12 14:56:29 UTC 2024 - Deploying certificate /var/lib/acme/mail.domain-00.com/cert.pem...
Fri Jul 12 14:56:29 UTC 2024 - Verified hashes.
Fri Jul 12 14:56:29 UTC 2024 - Certificate successfully obtained
Fri Jul 12 14:56:29 UTC 2024 - Reloading or restarting services... (1)
Reloading Nginx...
Restarting 0de8e279a9ad121b842b4fc6793358717b42a2e076d46ced721c586a26db17af...
command completed successfully
Restarting 0070a4fcb39a32cc045b9acaeb68e2fb3d5c482f58ff814a75144d00cfdef976...
command completed successfully
Fri Jul 12 14:56:42 UTC 2024 - Waiting for containers to settle...
Fri Jul 12 14:56:52 UTC 2024 - Certificates were successfully renewed where required, sleeping for another day.


### I NOTICE THAT THE CERTIFICATE WASN'T RENEWED HERE - I RESTART THE ACME CONTAINER ###


Fri Jul 12 15:11:05 UTC 2024 - Waiting for Docker API...
Fri Jul 12 15:11:05 UTC 2024 - Docker API OK
Fri Jul 12 15:11:05 UTC 2024 - Waiting for Postfix...
Fri Jul 12 15:11:05 UTC 2024 - Postfix OK
Fri Jul 12 15:11:05 UTC 2024 - Waiting for Dovecot...
Fri Jul 12 15:11:05 UTC 2024 - Dovecot OK
Fri Jul 12 15:11:05 UTC 2024 - Waiting for database...
Fri Jul 12 15:11:05 UTC 2024 - Database OK
Fri Jul 12 15:11:05 UTC 2024 - Waiting for Nginx...
Fri Jul 12 15:11:05 UTC 2024 - Nginx OK
Fri Jul 12 15:11:05 UTC 2024 - Waiting for resolver...
Fri Jul 12 15:11:05 UTC 2024 - Resolver OK
Fri Jul 12 15:11:05 UTC 2024 - Waiting for domain table...
OK
Fri Jul 12 15:11:05 UTC 2024 - Initializing, please wait...
Fri Jul 12 15:11:06 UTC 2024 - Using existing domain rsa key /var/lib/acme/acme/key.pem
Fri Jul 12 15:11:06 UTC 2024 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem
Fri Jul 12 15:11:06 UTC 2024 - Found A record for mail.domain-01.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 15:11:06 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 15:11:06 UTC 2024 - Found A record for autodiscover.domain-01.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 15:11:06 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 15:11:06 UTC 2024 - Found A record for autoconfig.domain-01.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 15:11:06 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 15:11:06 UTC 2024 - Found A record for mail.domain-02.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 15:11:06 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 15:11:07 UTC 2024 - Found A record for autodiscover.domain-02.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 15:11:07 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 15:11:07 UTC 2024 - Found A record for autoconfig.domain-02.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 15:11:07 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 15:11:07 UTC 2024 - Found A record for autodiscover.domain-00.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 15:11:07 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 15:11:07 UTC 2024 - Found A record for autoconfig.domain-00.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 15:11:07 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 15:11:07 UTC 2024 - Found A record for mail.domain-00.com: <CORRECT-IP-ADDRESS>
(skipping check, returning 0)
Fri Jul 12 15:11:07 UTC 2024 - Confirmed A record <CORRECT-IP-ADDRESS>
Fri Jul 12 15:11:07 UTC 2024 - Certificate /var/lib/acme/mail.domain-00.com/cert.pem missing or changed domains 'mail.domain-00.com autoconfig.domain-01.com autoconfig.domain-02.com autoconfig.domain-00.com autodiscover.domain-01.com autodiscover.domain-02.com autodiscover.domain-00.com mail.domain-01.com mail.domain-02.com' - start obtaining
Fri Jul 12 15:11:07 UTC 2024 - Creating backups in /var/lib/acme/backups/mail.domain-00.com/2024-07-12_15_11_07 ...
Fri Jul 12 15:11:07 UTC 2024 - Checking resolver...
Fri Jul 12 15:11:07 UTC 2024 - Resolver OK
Fri Jul 12 15:11:07 UTC 2024 - Using command acme-tiny   --account-key /var/lib/acme/acme/account.pem --disable-check --csr /var/lib/acme/mail.domain-00.com/acme.csr --acme-dir /var/www/acme/
Parsing account key...
Parsing CSR...
Found domains: autoconfig.domain-02.com, autoconfig.domain-00.com, autodiscover.domain-01.com, autodiscover.domain-00.com, mail.domain-00.com, autodiscover.domain-02.com, mail.domain-02.com, autoconfig.domain-01.com, mail.domain-01.com
Getting directory...
Directory found!
Registering account...
Already registered! Account ID: https://acme-v02.api.letsencrypt.org/acme/acct/<SNIP>
Creating new order...
Order created!
Already verified: autoconfig.domain-01.com, skipping...
Already verified: autoconfig.domain-02.com, skipping...
Already verified: autoconfig.domain-00.com, skipping...
Already verified: autodiscover.domain-01.com, skipping...
Already verified: autodiscover.domain-02.com, skipping...
Already verified: autodiscover.domain-00.com, skipping...
Already verified: mail.domain-01.com, skipping...
Already verified: mail.domain-02.com, skipping...
Already verified: mail.domain-00.com, skipping...
Signing certificate...
Certificate signed!
Fri Jul 12 15:11:14 UTC 2024 - Deploying certificate /var/lib/acme/mail.domain-00.com/cert.pem...
Fri Jul 12 15:11:14 UTC 2024 - Verified hashes.
Fri Jul 12 15:11:14 UTC 2024 - Certificate successfully obtained
Fri Jul 12 15:11:14 UTC 2024 - Reloading or restarting services... (1)
Reloading Nginx...
Restarting 0de8e279a9ad121b842b4fc6793358717b42a2e076d46ced721c586a26db17af...
command completed successfully
Restarting 0070a4fcb39a32cc045b9acaeb68e2fb3d5c482f58ff814a75144d00cfdef976...
command completed successfully
Fri Jul 12 15:11:20 UTC 2024 - Waiting for containers to settle...
Fri Jul 12 15:11:30 UTC 2024 - Certificates were successfully renewed where required, sleeping for another day.

XaTTa6bl4

Faster_Than_Light
I encountered exactly the same problem. Only one domain periodically does not determine the IP, although it is served by the same DNS server. And with any manual checks, the IP is determined always.

One day with error:
acme-mailcow-1 | Thu Sep 26 11:19:13 MSK 2024 - No A or AAAA record found for hostname mail.domain1.com acme-mailcow-1 | Thu Sep 26 11:19:13 MSK 2024 - Found A record for smtp.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:13 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:14 MSK 2024 - Found A record for imap.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:14 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:14 MSK 2024 - Found A record for pop.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:14 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:14 MSK 2024 - Found A record for pop3.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:14 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:15 MSK 2024 - Found A record for autodiscover.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:15 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:15 MSK 2024 - Found A record for autoconfig.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:15 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:15 MSK 2024 - Found A record for mx.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:15 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Thu Sep 26 11:19:16 MSK 2024 - Certificate /var/lib/acme/mx.domain1.com/cert.pem missing or changed domains 'mx.domain1.com autoconfig.domain2.com autoconfig.domain1.com a utodiscover.domain2.com autodiscover.domain1.com imap.domain2.com imap.domain1.com mail.domain2.com mx.domain2.com pop.domain2.com pop.domain1.com pop3.domain2.com pop3. domain1.com smtp.domain2.com smtp.domain1.com' - start obtaining acme-mailcow-1 | Thu Sep 26 11:19:16 MSK 2024 - Creating backups in /var/lib/acme/backups/mx.domain1.com/2024-09-26_11_19_16 ... acme-mailcow-1 | Thu Sep 26 11:19:16 MSK 2024 - Checking resolver... acme-mailcow-1 | Thu Sep 26 11:19:16 MSK 2024 - Resolver OK

another day OK:
acme-mailcow-1 | Fri Sep 27 11:22:05 MSK 2024 - Using existing domain rsa key /var/lib/acme/acme/key.pem acme-mailcow-1 | Fri Sep 27 11:22:05 MSK 2024 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem acme-mailcow-1 | Fri Sep 27 11:22:05 MSK 2024 - Detecting IP addresses... acme-mailcow-1 | Fri Sep 27 11:22:26 MSK 2024 - OK: <CORRECT-IP-ADDRESS>, 0000:0000:0000:0000:0000:0000:0000:0000 acme-mailcow-1 | Fri Sep 27 11:22:26 MSK 2024 - Found A record for mx.domain2.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:27 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:27 MSK 2024 - Found A record for mail.domain2.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:27 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:27 MSK 2024 - Found A record for smtp.domain2.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:27 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:27 MSK 2024 - Found A record for imap.domain2.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:27 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:27 MSK 2024 - Found A record for pop.domain2.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:27 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:27 MSK 2024 - Found A record for pop3.domain2.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:27 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:28 MSK 2024 - Found A record for autodiscover.domain2.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:28 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:28 MSK 2024 - Found A record for autoconfig.domain2.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:28 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:28 MSK 2024 - Found A record for mail.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:28 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:28 MSK 2024 - Found A record for smtp.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:28 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Found A record for imap.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Found A record for pop.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Found A record for pop3.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Found A record for autodiscover.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Found A record for autoconfig.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Found A record for mx.domain1.com: <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Confirmed A record <CORRECT-IP-ADDRESS> acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Certificate /var/lib/acme/mx.domain1.com/cert.pem missing or changed domains 'mx.domain1.com autoconfig.domain2.com autoconfig.domain1.com autodiscover.domain2.com autodiscover.domain1.com imap.domain2.com imap.domain1.com mail.domain2.com mail.domain1.com mx.domain2.com pop.domain2.com pop.domain1.com pop3.domain2.com pop3.domain1.com smtp.domain2.com smtp.domain1.com' - start obtaining acme-mailcow-1 | Fri Sep 27 11:22:29 MSK 2024 - Creating backups in /var/lib/acme/backups/mx.domain1.com/2024-09-27_11_22_29 ... acme-mailcow-1 | Fri Sep 27 11:22:30 MSK 2024 - Checking resolver... acme-mailcow-1 | Fri Sep 27 11:22:31 MSK 2024 - Resolver OK

Because of these failures, the certificate is reissued too often and there is no service on one domain for a long time. I think that the check should be implemented differently, and for example, if the certificate has not expired yet, and the IP address was resolved for fewer domains than the current certificate, then the new certificate should not be reissued.

chriss

I might have seen a similar/related problem: More detailed unbound logs?
I suspected it to be a DNS timeout issue.
Hasn’t happened again recently to get unbound logs.

Faster_Than_Light

I’d settle for having an option in the mailcow.conf file to just restart the acme container every 5 minutes if it can’t find A or AAAA records. That way people who know that the DNS is correct, won’t have to worry about resources being hogged, and people who don’t have the issue can just leave it set to false.
Because that’s how I solve the problem, but having to login to my server when it happens (and noticing that its happened in the first place, too), is a real PITA.

Faster_Than_Light

If anyone else is struggling with this, and comes across this post from Google (or wherever), I wrote the following script:

/opt/mailcow-dockerized/check_for_failed_certificates.sh

#!/bin/bash

# Container name
CONTAINER_NAME="mailcowdockerized-acme-mailcow-1"

# Command to check the logs
LOG_CHECK="docker container logs $CONTAINER_NAME"

# Check if the logs contain the specified string
if $LOG_CHECK | grep -q "No A or AAAA record found"; then
  # If the string is found, execute the necessary commands
  docker container stop $CONTAINER_NAME
  docker container rm $CONTAINER_NAME
  docker compose -f /opt/mailcow-dockerized/docker-compose.yml up -d
fi

[What this does is look through the logs from the acme container, and checks to see if it contains No A or AAAA record found anywhere in it. If it does, then it stops and removes the container, and then recreates it from the docker compose configuration file.]

Then make it executable by running:

sudo chmod +x /opt/mailcow-dockerized/check_for_failed_certificates.sh

Finally, set up a cron job by typing:

sudo crontab -e

And entering the following, to run the script every 10 minutes:

*/10 * * * * /opt/mailcow-dockerized/check_for_failed_certificates.sh > /dev/null 2>&1

[The extra bits, > /dev/null 2>&1, just ensures that any output the script gives is disposed of.]

10 minutes might seem aggressive, but it uses very little resources to run, and your email client will fail to connect to any servers that don’t have a valid SSL/TLS certificate, which is kind of a big deal.

Hope this helps someone. 🙂