ACME HTTP validation failed

TueJon

I am facing an issue with the acme container failing to create a new Lets Encrypt certificate.

Sun Sep 1 20:22:28 CEST 2024 - Initializing, please wait... Sun Sep 1 20:22:28 CEST 2024 - Using existing domain rsa key /var/lib/acme/acme/key.pem Sun Sep 1 20:22:28 CEST 2024 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem Sun Sep 1 20:22:28 CEST 2024 - Detecting IP addresses... Sun Sep 1 20:22:28 CEST 2024 - OK: 46.38.255.184, 2a03:4000:19:39:585c:6ff:fe9e:35ec Sun Sep 1 20:22:28 CEST 2024 - Found AAAA record for autodiscover.jonastuechler.at: 2a03:4000:19:39:585c:6ff:fe9e:35ec - skipping A record check Sun Sep 1 20:22:28 CEST 2024 - Confirmed AAAA record with IP 2a03:4000:0019:0039:585c:06ff:fe9e:35ec, but HTTP validation failed Sun Sep 1 20:22:28 CEST 2024 - Found AAAA record for autoconfig.jonastuechler.at: 2a03:4000:19:39:585c:6ff:fe9e:35ec - skipping A record check Sun Sep 1 20:22:28 CEST 2024 - Confirmed AAAA record with IP 2a03:4000:0019:0039:585c:06ff:fe9e:35ec, but HTTP validation failed Sun Sep 1 20:22:28 CEST 2024 - Found AAAA record for autodiscover.thomb.at: 2a03:4000:19:39:585c:6ff:fe9e:35ec - skipping A record check Sun Sep 1 20:22:28 CEST 2024 - Confirmed AAAA record with IP 2a03:4000:0019:0039:585c:06ff:fe9e:35ec, but HTTP validation failed Sun Sep 1 20:22:28 CEST 2024 - Found AAAA record for autoconfig.thomb.at: 2a03:4000:19:39:585c:6ff:fe9e:35ec - skipping A record check Sun Sep 1 20:22:28 CEST 2024 - Confirmed AAAA record with IP 2a03:4000:0019:0039:585c:06ff:fe9e:35ec, but HTTP validation failed Sun Sep 1 20:22:28 CEST 2024 - Found AAAA record for autodiscover.tuejon.at: 2a03:4000:19:39:585c:6ff:fe9e:35ec - skipping A record check Sun Sep 1 20:22:28 CEST 2024 - Confirmed AAAA record with IP 2a03:4000:0019:0039:585c:06ff:fe9e:35ec, but HTTP validation failed Sun Sep 1 20:22:28 CEST 2024 - Found AAAA record for autoconfig.tuejon.at: 2a03:4000:19:39:585c:6ff:fe9e:35ec - skipping A record check Sun Sep 1 20:22:28 CEST 2024 - Confirmed AAAA record with IP 2a03:4000:0019:0039:585c:06ff:fe9e:35ec, but HTTP validation failed Sun Sep 1 20:22:28 CEST 2024 - Found AAAA record for mail.jonastuechler.at: 2a03:4000:19:39:585c:6ff:fe9e:35ec - skipping A record check Sun Sep 1 20:22:28 CEST 2024 - Confirmed AAAA record with IP 2a03:4000:0019:0039:585c:06ff:fe9e:35ec, but HTTP validation failed Sun Sep 1 20:22:28 CEST 2024 - Cannot validate any hostnames, skipping Let's Encrypt for 1 hour. Sun Sep 1 20:22:28 CEST 2024 - Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently. OK

Everything with my mailcow setup works fine, I can send and receive mails and they are not landing in spam, but connecting to my server with most mail client fails because of an expired certificate.

I use Nginx for a proxy to reach mailcow via mail.jonastuechler.at to the host port 8080 and 8443.
Read many threads on the community forum and other pages but nothing helped fixing the issue. Does anyone have an idea what could the the problem here?

DocFraggle

ACME found an AAAA (IPv6) record for your hostnames and is trying to validate it via http. Did you forward IPv6 through your reverse proxy as well? It seems that http via IPv6 doesn’t get through

TueJon

I have no specific setting on the proxy for IPv6.

Here is my proxy config:

server {
    server_name mail.jonastuechler.at www.mail.jonastuechler.at mail.tuejon.at www.mail.tuejon.at mail.thomb.at www.mail.thomb.at autodiscover.* autoconfig.*;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }


    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mail.jonastuechler.at/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mail.jonastuechler.at/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = www.mail.tuejon.at) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = mail.tuejon.at) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = www.mail.jonastuechler.at) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = mail.jonastuechler.at) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name mail.jonastuechler.at www.mail.jonastuechler.at mail.tuejon.at www.mail.tuejon.at autodiscover.* autoconfig.*;
    listen 80;
    return 404; # managed by Certbot
}
tj@tuejon:/etc/nginx/sites-available$

DocFraggle

That’s the problem then. You have two options: configure your reverse proxy to proxy IPv6 as well or remove your IPv6 DNS entries

TueJon

Great, thank you, it’s fixed by adding listen [::]:443 ssl and listen [::]:80; to the corresponding server blocks.