Obtaining CA Certs

Dvalin21

I saw that 104 ip before, but it had changed later on when I check the dns settings the second time. I have no clue where its coming from. The other is a docker ip address. Should be pointing to the 172 ip or the public Ip?

Dvalin21

So I fixed that part of it, the autoconfig……apparently I forgot to set the cname record for autoconfig. DUH. I’m currently waiting to see if that will fix my issue. The 104. ip address is a CDN for cloudflare. So thats why you got that. (To be fair I used chatgpt to figure that out) However, from the thirdparty app that Im trying to use smtp with (invoiceninja) I get the following when I run the test function

Unable to connect with STARTTLS: stream_socket_enable_crypto(): SSL operation failed with code 1. OpenSSL Error messages:
error:0A000086:SSL routines::certificate verify failed

Which I do have it setup correctly with port 587, STARTTLS, username and password of course .

DocFraggle

Ok, try to force a renewal now that the DNS entry is fixed:

https://docs.mailcow.email/post_installation/firststeps-ssl/#force-renewal

Dvalin21

So I went back, deleted the ssl folder, made a change to the env adding my email address to the ACME_CONTACT and here is what I got.

acme-mailcow-1       |   File "/usr/lib/python3.12/site-packages/acme_tiny.py", line 153, in get_crt
acme-mailcow-1       |     raise ValueError("Challenge did not pass for {0}: {1}".format(domain, authorization))
acme-mailcow-1       | ValueError: Challenge did not pass for autoconfig.houseofmanns.com: {'identifier': {'type': 'dns', 'value': 'autoconfig.houseofmanns.com'}, 'status': 'invalid', 'expires': '2024-12-16T20:15:30Z', 'challenges': [{'type': 'http-01', 'url': 'https://acme-v02.api.letsencrypt.org/acme/chall/2103738317/442398592827/equTPQ', 'status': 'invalid', 'validated': '2024-12-09T20:15:31Z', 'error': {'type': 'urn:ietf:params:acme:error:unauthorized', 'detail': 'my public ip: Invalid response from http://autoconfig.houseofmanns.com/.well-known/acme-challenge/ 404, status 403
'validationRecord': [{'url': 'http://autoconfig.houseofmanns.com/.well-known/acme-challenge/rOEn6gTtsqkr8g0HbmDlcni1SjTkYB7JeKoqP8Ztx3U', 'hostname': 'autoconfig.houseofmanns.com', 'port': '80', 'addressesResolved': ['public ip'], 'addressUsed': 'public ip'}]}]}
acme-mailcow-1       | Mon Dec  9 14:15:31 CST 2024 - Failed to obtain certificate /var/lib/acme/mail.houseofmanns.com/cert.pem for domains 'mail.houseofmanns.com autoconfig.houseofmanns.com'
acme-mailcow-1       | OK

Dvalin21

DO you know if mailcow has issues with cloudflare? Its just a thought. Also, it seems like the challenge token mailcow generates is causing an issue.

esackbauer

It seems cloudflare is a PITA for most here. Mailcow was engineered so you can use it directly with a public IP address. And most important protocols SMTP and IMAP won’t work with cloudflare unless you spend 5000$/month on Cloudflares enterprise offering.

Dvalin21

esackbauer Thanks for that. Sounds like I need to find something other than Cloudflare.

[unknown] My apologies, yes I am behind a reverse proxy, using cloudflare. The only thing that is behind the reverse proxy is the webui.

[unknown]

Thanks and sorry, yes I am behind a reverse proxy, but the only thing behind it is the webui. Everything is trying to pull certs for the autoconfig, autodiscover etc..

[unknown]

Thanks and sorry, yes I am behind a reverse proxy, but the only thing behind it is the webui. Everything is trying to pull certs for the autoconfig, autodiscover etc..

DocFraggle

There is still something really broken in your setup… if I try

http://autoconfig.houseofmanns.com/.well-known/acme-challenge/

I get

while it should look like this:

So “openresty” sounds much like some kind of reverse proxy which I already asked you about. So if you don’t tell us about your setup I’m out of here.

Dvalin21

So after removing cloudflare, I’m not getting the “Congratulations” page for nginx. However I still get the challenge token error.

Dvalin21

So, I tried to switch to another mail service to see if I’m having the same problem. What I notice is what I posted before is that I keep getting the following errors TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher, session=<yro2S/ooiACsFgAG>

I don’t know what is causing that error. I have the certs right, I have dns right, I’ve went away from cloudflare and back to my host porkbun. What in the work am I missing?

DocFraggle

http://autoconfig.houseofmanns.com/.well-known/acme-challenge/ still shows me the openresty stuff…

Dvalin21

DocFraggle
So I do have my domain tied to nginx proxy manager, is this an issue?

DocFraggle

Not if you configure it correctly… the above URL doesn’t get proxied to mailcow

Dvalin21

DocFraggle

Any other ideas? Right now I have it down, will bring back up shortly. I don’t know if its the certs im using or the naming scheme or what. It just fails each time

DocFraggle

When the ACME client is trying to issue a certificate it creates a file on your mailcow server. Letsencrypt then tries to access this file, which in your case isn’t possible because your reverse proxy doesn’t proxy

http://autoconfig.houseofmanns.com/.well-known/acme-challenge/rOEn6gTtsqkr8g0HbmDlcni1SjTkYB7JeKoqP8Ztx3U

(The example from your log above)

As long as you don’t fix or get rid of your reverse proxy it won’t work

Dvalin21

DocFraggle
So how should I fix my proxy? I have my domain attached, but don’t have a proxy for the ip of the mailcow. So not sure what else I could do.

Dvalin21

The instructions says that if your using a reverse proxy, that you should use 127.0.0.1 for the binding in the env. But when I tried that, I was never able to access the web interface.

DocFraggle

Dvalin21 The instructions says that if your using a reverse proxy, that you should use 127.0.0.1 for the binding in the env.

Yes, that’s if you use a local reverse proxy running directly on the mailcow host.
If you use Cloudflare you have to bind to you external IP.
I don’t have the slightest idea about how to configure Cloudflare though…

Dvalin21

DocFraggle

So good knews, I was able to get the cert to work…….now I can’t delete emails….sigh. I removed my domain from cloudflare, but I am behind npm. I didn’t have to use the 127.0.0.1 in the binding.

Update: Restarted container, all is well.

Fix

Downloaded certs from NPM.

Fullchain,pem = cert.pem
Permission: 644
Privkey.pem = key.pem
Permission: 600

Disabled Letsencrypted
Verify IP
Verify HTTP

Setup dns as suppose to.