SSL certificates for addon domains ramdomly drop

IncubuzzCC

Hi all,
I have a strange behavior on my mailcow, which is kind of an annoyance:
There is 1 main domain and 4 additional domains.
All of them are correctly setup with DNS on Cloudflare (without Proxy) and have a mail.tld.
All of them have up to date certificates and the auto-update works correctly…

Now every once in a while one of the additional domain certificates randomly disappears (unrelated to certificate expire date) and the certificate only shows the main domain name. This causes users which have configured the additional domain name as their mail server to receive an “untrusted” warning.

In order to fix it I simply run docker compose restart acme-mailcow and it fixes the issue reloading all certificates.

Any cue to what could case this?

Thanks

DocFraggle

Did you check the logs of the ACME container when there’s a certificate missing?

esackbauer

Are you using one SAN certificate for all domains? Or have you set ENABLE_SSL_SNI=y which would generate a certificate for each TLD individually.
With only 4 additional domains I would strongly suggest to not use SSL-SNI.

IncubuzzCC

Thank you for your replies.
I do use SAN. Today I had another occurrence today with another one of the additional domains.
Checking the Log I found the following:
Tue Jul 23 21:52:10 UTC 2024 - No A or AAAA record found for hostname mail.[adddomain].com Tue Jul 23 21:52:10 UTC 2024 - Found A record for autodiscover.[adddomain].com: [serverip] (skipping check, returning 0) Tue Jul 23 21:52:10 UTC 2024 - Confirmed A record [serverip] Tue Jul 23 21:52:11 UTC 2024 - Found A record for autoconfig.[adddomain].com: [serverip] (skipping check, returning 0) Tue Jul 23 21:52:11 UTC 2024 - Confirmed A record [serverip]

And on acme-mailcow restart it went normal again:
Wed Jul 24 16:28:21 UTC 2024 - Found A record for mail.[adddomain].com: [serverip] (skipping check, returning 0) Wed Jul 24 16:28:21 UTC 2024 - Confirmed A record [serverip] Wed Jul 24 16:28:22 UTC 2024 - Found A record for autodiscover.[adddomain].com: [serverip] (skipping check, returning 0) Wed Jul 24 16:28:22 UTC 2024 - Confirmed A record [serverip] Wed Jul 24 16:28:22 UTC 2024 - Found A record for autoconfig.[adddomain].com: [serverip] (skipping check, returning 0) Wed Jul 24 16:28:22 UTC 2024 - Confirmed A record [serverip]
I double checked the DNS settings and ran a dig command from the mail server. Everythings seems correctly setup.

chriss

Related posts.
Difficult to diagnose due to apparent randomness involved.

Random failure to obtain certificates (No A or AAAA record found for hostname)

More detailed unbound logs?