Obtaining CA Certs

Dvalin21

Can someone please give an update step by step instruction on obtain CA certs with mailcow? I’ve installed mailcow multiple times for several months and have never been able to get it to pull certs. I’ve tried the manual certs, which says to be put it in the /ssl/, but still it wouldn’t take the certs. I don’t get an error that says WHY it couldn’t obtain the certs. Just that it couldn’t. Any help would be great. Thanks.

update: Got this from povecot

err	doveadm: Error: SSL context initialization failed, disabling SSL: Couldn't parse private SSL key (ssl_key setting) (maybe ssl_key_password is wrong?): error:1E08010C:DECODER routines::unsupported: No supported data to decode. Input type: PEM

DocFraggle

Check the logs of your acme container

https://docs.mailcow.email/troubleshooting/debug-logs/

Dvalin21

DocFraggle I did, all I get is failed to obtain cert. Try again in 30 min

DocFraggle

Please paste the logs, you’ll find the reason in it

Dvalin21

DocFraggle

12/08/2024, 03:05:19 AM	mail.example.com - Some errors occurred, retrying in 30 minutes...
12/08/2024, 03:05:19 AM	mail.example.com - Failed to obtain certificate /var/lib/acme/mail.houseofmanns.com/cert.pem for domains 'mail.example.com  autoconfig.exmaple.com autodiscover.example.com'
12/08/2024, 03:05:19 AM	mail.example.com  - UGFyc2luZyBhY2NvdW50IGtleS4uLgpQYXJzaW5nIENTUi4uLgpGb3VuZCBkb21haW5zOiBhdXRvY29uZmlnLmhvdXNlb2ZtYW5ucy5jb20sIGF1dG9kaXNjb3Zlci5ob3VzZW9mbWFubnMuY29tLCBtYWlsLmhvdXNlb2ZtYW5ucy5jb20KR2V0dGluZyBkaXJlY3RvcnkuLi4KRGlyZWN0b3J5IGZvdW5kIQpSZWdpc3RlcmluZyBhY2NvdW50Li4uClJlZ2lzdGVyZWQhIEFjY291bnQgSUQ6IGh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMjEwMDkxNTE1NwpDcmVhdGluZyBuZXcgb3JkZXIuLi4KT3JkZXIgY3JlYXRlZCEKVmVyaWZ5aW5nIGF1dG9jb25maWcuaG91c2VvZm1hbm5zLmNvbS4uLgpUcmFjZWJhY2sgKG1vc3QgcmVjZW50IGNhbGwgbGFzdCk6CiAgRmlsZSAiL3Vzci9iaW4vYWNtZS10aW55IiwgbGluZSA4LCBpbiA8bW9kdWxlPgogICAgc3lzLmV4aXQobWFpbigpKQogICAgICAgICAgICAgXl5eXl5eCiAgRmlsZSAiL3Vzci9saWIvcHl0aG9uMy4xMi9zaXRlLXBhY2thZ2VzL2FjbWVfdGlueS5weSIsIGxpbmUgMTk1LCBpbiBtYWluCiAgICBzaWduZWRfY3J0ID0gZ2V0X2NydChhcmdzLmFjY291bnRfa2V5LCBhcmdzLmNzciwgYXJncy5hY21lX2RpciwgbG9nPUxPR0dFUiwgQ0E9YXJncy5jYSwgZGlzYWJsZV9jaGVjaz1hcmdzLmRpc2FibGVfY2hlY2ssIGRpcmVjdG9yeV91cmw9YXJncy5kaXJlY3RvcnlfdXJsLCBjb250YWN0PWFyZ3MuY29udGFjdCwgY2hlY2tfcG9ydD1hcmdzLmNoZWNrX3BvcnQpCiAgICAgICAgICAgICAgICAgXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eCiAgRmlsZSAiL3Vzci9saWIvcHl0aG9uMy4xMi9zaXRlLXBhY2thZ2VzL2FjbWVfdGlueS5weSIsIGxpbmUgMTUzLCBpbiBnZXRfY3J0CiAgICByYWlzZSBWYWx1ZUVycm9yKCJDaGFsbGVuZ2UgZGlkIG5vdCBwYXNzIGZvciB7MH06IHsxfSIuZm9ybWF0KGRvbWFpbiwgYXV0aG9yaXphdGlvbikpClZhbHVlRXJyb3I6IENoYWxsZW5nZSBkaWQgbm90IHBhc3MgZm9yIGF1dG9jb25maWcuaG91c2VvZm1hbm5zLmNvbTogeydpZGVudGlmaWVyJzogeyd0eXBlJzogJ2RucycsICd2YWx1ZSc6ICdhdXRvY29uZmlnLmhvdXNlb2ZtYW5ucy5jb20nfSwgJ3N0YXR1cyc6ICdpbnZhbGlkJywgJ2V4cGlyZXMnOiAnMjAyNC0xMi0xNVQwOTowNToxN1onLCAnY2hhbGxlbmdlcyc6IFt7J3R5cGUnOiAnaHR0cC0wMScsICd1cmwnOiAnaHR0cHM6Ly9hY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvY2hhbGwvMjEwMDkxNTE1Ny80NDE2OTI4NzM3MDcvclcwczlRJywgJ3N0YXR1cyc6ICdpbnZhbGlkJywgJ3ZhbGlkYXRlZCc6ICcyMDI0LTEyLTA4VDA5OjA1OjE4WicsICdlcnJvcic6IHsndHlwZSc6ICd1cm46aWV0ZjpwYXJhbXM6YWNtZTplcnJvcjp1bmF1dGhvcml6ZWQnLCAnZGV0YWlsJzogJzI2MDY6NDcwMDozMDMzOjo2ODE1OjJiYTU6IEludmFsaWQgcmVzcG9uc2UgZnJvbSBodHRwOi8vYXV0b2NvbmZpZy5ob3VzZW9mbWFubnMuY29tLy53ZWxsLWtub3duL2FjbWUtY2hhbGxlbmdlL0RtTlVqUkUycVNiaFY2UXFQNmNLOENaelRQWHBHT3RVYl9uVUcxUF96dm86IDQwNCcsICdzdGF0dXMnOiA0MDN9LCAndG9rZW4nOiAnRG1OVWpSRTJxU2JoVjZRcVA2Y0s4Q1p6VFBYcEdPdFViX25VRzFQX3p2bycsICd2YWxpZGF0aW9uUmVjb3JkJzogW3sndXJsJzogJ2h0dHA6Ly9hdXRvY29uZmlnLmhvdXNlb2ZtYW5ucy5jb20vLndlbGwta25vd24vYWNtZS1jaGFsbGVuZ2UvRG1OVWpSRTJxU2JoVjZRcVA2Y0s4Q1p6VFBYcEdPdFViX25VRzFQX3p2bycsICdob3N0bmFtZSc6ICdhdXRvY29uZmlnLmhvdXNlb2ZtYW5ucy5jb20nLCAncG9ydCc6ICc4MCcsICdhZGRyZXNzZXNSZXNvbHZlZCc6IFsnMTA0LjIxLjQzLjE2NScsICcxNzIuNjcuMTgxLjE4NCcsICcyNjA2OjQ3MDA6MzAzMzo6NjgxNToyYmE1JywgJzI2MDY6NDcwMDozMDM2OjphYzQzOmI1YjgnXSwgJ2FkZHJlc3NVc2VkJzogJzI2MDY6NDcwMDozMDMzOjo2ODE1OjJiYTUnfV19XX0K
12/08/2024, 03:05:15 AM	- Using command acme-tiny --account-key /var/lib/acme/acme/account.pem --disable-check --csr /var/lib/acme/mail.example.com /acme.csr --acme-dir /var/www/acme/
12/08/2024, 03:05:15 AM	 - Resolver OK
12/08/2024, 03:05:15 AM	 - Checking resolver...
12/08/2024, 03:05:15 AM	 - Copying shared private key for this certificate...
12/08/2024, 03:05:15 AM	 - Certificate /var/lib/acme/mail.example.com /cert.pem missing or changed domains 'mail.example.com autoconfig. autodiscover.' - start obtaining
12/08/2024, 03:05:15 AM	- Confirmed A record 
12/08/2024, 03:05:15 AM	 - Found A record for mail.example.com : 
12/08/2024, 03:05:15 AM	mail.example.com  - Confirmed AAAA record with IP 
12/08/2024, 03:05:15 AM	mail.example.com  - Found AAAA record for autoconfig.: 2
- skipping A record check
12/08/2024, 03:05:14 AM	 - Confirmed A record 162.250.157.45
12/08/2024, 03:05:14 AM	- Found A record for autodiscover.
12/08/2024, 03:05:13 AM	 - Generating missing Lets Encrypt account key...
12/08/2024, 03:05:13 AM	 - Generating missing domain private rsa key...
12/08/2024, 03:05:13 AM	 - Initializing, please wait...
12/08/2024, 03:05:13 AM	 - OK
12/08/2024, 03:05:13 AM	 - Waiting for domain table...
12/08/2024, 03:05:13 AM	 - Resolver OK
12/08/2024, 03:05:11 AM	 - Waiting for resolver...
12/08/2024, 03:05:11 AM	 - Waiting for Nginx...
12/08/2024, 03:05:11 AM	 - Database OK
12/08/2024, 03:05:11 AM	 - Waiting for database...
12/08/2024, 03:05:11 AM	- Dovecot OK
12/08/2024, 03:05:11 AM	 Waiting for Dovecot...
12/08/2024, 03:05:11 AM	 - Postfix OK
12/08/2024, 03:05:11 AM	- Waiting for Postfix...
12/08/2024, 03:05:11 AM	 - Docker API OK

DocFraggle

acme-mailcow-1       |   File "/usr/bin/acme-tiny", line 8, in <module>
acme-mailcow-1       |     sys.exit(main())
acme-mailcow-1       |              ^^^^^^
acme-mailcow-1       |   File "/usr/lib/python3.12/site-packages/acme_tiny.py", line 195, in main
acme-mailcow-1       |     signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca, disable_check=args.disable_check, directory_url=args.directory_url, contact=args.contact, check_port=args.check_port)
acme-mailcow-1       |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
acme-mailcow-1       |   File "/usr/lib/python3.12/site-packages/acme_tiny.py", line 153, in get_crt

DocFraggle

acme-mailcow-1       |   File "/usr/bin/acme-tiny", line 8, in <module>
acme-mailcow-1       |     sys.exit(main())
acme-mailcow-1       |              ^^^^^^
acme-mailcow-1       |   File "/usr/lib/python3.12/site-packages/acme_tiny.py", line 195, in main
acme-mailcow-1       |     signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca, disable_check=args.disable_check, directory_url=args.directory_url, contact=args.contact, check_port=args.check_port)
acme-mailcow-1       |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
acme-mailcow-1       |   File "/usr/lib/python3.12/site-packages/acme_tiny.py", line 153, in get_crt

acme-mailcow-1       |   File "/usr/bin/acme-tiny", line 8, in <module>
acme-mailcow-1       |     sys.exit(main())
acme-mailcow-1       |              ^^^^^^
acme-mailcow-1       |   File "/usr/lib/python3.12/site-packages/acme_tiny.py", line 195, in main
acme-mailcow-1       |     signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca, disable_check=args.disable_check, directory_url=args.directory_url, contact=args.contact, check_port=args.check_port)
acme-mailcow-1       |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
acme-mailcow-1       |   File "/usr/lib/python3.12/site-packages/acme_tiny.py", line 153, in get_crt

Sorry, wasn’t trying to post that multiple times in a row. I was getting an error before I refreshed

DocFraggle

What did you configure in your mailcow.conf? Any specials for ADDITIONAL_SAN?

EDIT: I see you’re using Cloudflare? Are you using a reverse proxy?

Dvalin21

DocFraggle

No, nothing special. No additional lans or anything like that. Also, I set it, but I get a Red 🔺️ I used mail tester and it says it’s not set. I’m able to send and receive email. However, if I attach mailcow to say thunderbird or some other third party app, it says it can’t find the cert for it

DocFraggle

Your autoconfig DNS entry seeems to be wqrong, it points to 2 IP addresses which don’t match your mailcow IP (Cloudflare)

# dig autoconfig.houseofmanns.com +short
172.67.181.184
104.21.43.165

I guess that Thunderbird etc. fail due to this. Also, the certificate can’t be obtained for this SAN if it doesn’t point to your mailcow. Change the DNS entry to your mailcow IP 162.250.157.45

Dvalin21

DocFraggle

I saw that 104 ip before, but it had changed later on when I check the dns settings the second time. I have no clue where its coming from. The other is a docker ip address. Should be pointing to the 172 ip or the public Ip?

Dvalin21

So I fixed that part of it, the autoconfig……apparently I forgot to set the cname record for autoconfig. DUH. I’m currently waiting to see if that will fix my issue. The 104. ip address is a CDN for cloudflare. So thats why you got that. (To be fair I used chatgpt to figure that out) However, from the thirdparty app that Im trying to use smtp with (invoiceninja) I get the following when I run the test function

Unable to connect with STARTTLS: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages:
error:0A000086:SSL routines::certificate verify failed

Which I do have it setup correctly with port 587, STARTTLS, username and password of course .

DocFraggle

Ok, try to force a renewal now that the DNS entry is fixed:

https://docs.mailcow.email/post_installation/firststeps-ssl/#force-renewal

Dvalin21

So I went back, deleted the ssl folder, made a change to the env adding my email address to the ACME_CONTACT and here is what I got.

acme-mailcow-1       |   File "/usr/lib/python3.12/site-packages/acme_tiny.py", line 153, in get_crt
acme-mailcow-1       |     raise ValueError("Challenge did not pass for {0}: {1}".format(domain, authorization))
acme-mailcow-1       | ValueError: Challenge did not pass for autoconfig.houseofmanns.com: {'identifier': {'type': 'dns', 'value': 'autoconfig.houseofmanns.com'}, 'status': 'invalid', 'expires': '2024-12-16T20:15:30Z', 'challenges': [{'type': 'http-01', 'url': 'https://acme-v02.api.letsencrypt.org/acme/chall/2103738317/442398592827/equTPQ', 'status': 'invalid', 'validated': '2024-12-09T20:15:31Z', 'error': {'type': 'urn:ietf:params:acme:error:unauthorized', 'detail': 'my public ip: Invalid response from http://autoconfig.houseofmanns.com/.well-known/acme-challenge/ 404, status 403
'validationRecord': [{'url': 'http://autoconfig.houseofmanns.com/.well-known/acme-challenge/rOEn6gTtsqkr8g0HbmDlcni1SjTkYB7JeKoqP8Ztx3U', 'hostname': 'autoconfig.houseofmanns.com', 'port': '80', 'addressesResolved': ['public ip'], 'addressUsed': 'public ip'}]}]}
acme-mailcow-1       | Mon Dec  9 14:15:31 CST 2024 - Failed to obtain certificate /var/lib/acme/mail.houseofmanns.com/cert.pem for domains 'mail.houseofmanns.com autoconfig.houseofmanns.com'
acme-mailcow-1       | OK

Dvalin21

DO you know if mailcow has issues with cloudflare? Its just a thought. Also, it seems like the challenge token mailcow generates is causing an issue.

esackbauer

It seems cloudflare is a PITA for most here. Mailcow was engineered so you can use it directly with a public IP address. And most important protocols SMTP and IMAP won’t work with cloudflare unless you spend 5000$/month on Cloudflares enterprise offering.

Dvalin21

esackbauer Thanks for that. Sounds like I need to find something other than Cloudflare.

[unknown] My apologies, yes I am behind a reverse proxy, using cloudflare. The only thing that is behind the reverse proxy is the webui.

[unknown]

Thanks and sorry, yes I am behind a reverse proxy, but the only thing behind it is the webui. Everything is trying to pull certs for the autoconfig, autodiscover etc..

[unknown]

Thanks and sorry, yes I am behind a reverse proxy, but the only thing behind it is the webui. Everything is trying to pull certs for the autoconfig, autodiscover etc..

DocFraggle

There is still something really broken in your setup… if I try

http://autoconfig.houseofmanns.com/.well-known/acme-challenge/

I get

while it should look like this:

So “openresty” sounds much like some kind of reverse proxy which I already asked you about. So if you don’t tell us about your setup I’m out of here.

Dvalin21

So after removing cloudflare, I’m not getting the “Congratulations” page for nginx. However I still get the challenge token error.

Dvalin21

So, I tried to switch to another mail service to see if I’m having the same problem. What I notice is what I posted before is that I keep getting the following errors TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher, session=<yro2S/ooiACsFgAG>

I don’t know what is causing that error. I have the certs right, I have dns right, I’ve went away from cloudflare and back to my host porkbun. What in the work am I missing?

DocFraggle

http://autoconfig.houseofmanns.com/.well-known/acme-challenge/ still shows me the openresty stuff…

Dvalin21

DocFraggle
So I do have my domain tied to nginx proxy manager, is this an issue?