Obtaining CA Certs

Dvalin21

esackbauer Thanks for that. Sounds like I need to find something other than Cloudflare.

[unknown] My apologies, yes I am behind a reverse proxy, using cloudflare. The only thing that is behind the reverse proxy is the webui.

[unknown]

Thanks and sorry, yes I am behind a reverse proxy, but the only thing behind it is the webui. Everything is trying to pull certs for the autoconfig, autodiscover etc..

[unknown]

Thanks and sorry, yes I am behind a reverse proxy, but the only thing behind it is the webui. Everything is trying to pull certs for the autoconfig, autodiscover etc..

Dvalin21

So after removing cloudflare, I’m not getting the “Congratulations” page for nginx. However I still get the challenge token error.

Dvalin21

So, I tried to switch to another mail service to see if I’m having the same problem. What I notice is what I posted before is that I keep getting the following errors TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher, session=<yro2S/ooiACsFgAG>

I don’t know what is causing that error. I have the certs right, I have dns right, I’ve went away from cloudflare and back to my host porkbun. What in the work am I missing?

DocFraggle

http://autoconfig.houseofmanns.com/.well-known/acme-challenge/ still shows me the openresty stuff…

Dvalin21

DocFraggle
So I do have my domain tied to nginx proxy manager, is this an issue?

DocFraggle

Not if you configure it correctly… the above URL doesn’t get proxied to mailcow

Dvalin21

DocFraggle

Any other ideas? Right now I have it down, will bring back up shortly. I don’t know if its the certs im using or the naming scheme or what. It just fails each time

DocFraggle

When the ACME client is trying to issue a certificate it creates a file on your mailcow server. Letsencrypt then tries to access this file, which in your case isn’t possible because your reverse proxy doesn’t proxy

http://autoconfig.houseofmanns.com/.well-known/acme-challenge/rOEn6gTtsqkr8g0HbmDlcni1SjTkYB7JeKoqP8Ztx3U

(The example from your log above)

As long as you don’t fix or get rid of your reverse proxy it won’t work

Dvalin21

DocFraggle
So how should I fix my proxy? I have my domain attached, but don’t have a proxy for the ip of the mailcow. So not sure what else I could do.

Dvalin21

The instructions says that if your using a reverse proxy, that you should use 127.0.0.1 for the binding in the env. But when I tried that, I was never able to access the web interface.

DocFraggle

Dvalin21 The instructions says that if your using a reverse proxy, that you should use 127.0.0.1 for the binding in the env.

Yes, that’s if you use a local reverse proxy running directly on the mailcow host.
If you use Cloudflare you have to bind to you external IP.
I don’t have the slightest idea about how to configure Cloudflare though…

Dvalin21

DocFraggle

So good knews, I was able to get the cert to work…….now I can’t delete emails….sigh. I removed my domain from cloudflare, but I am behind npm. I didn’t have to use the 127.0.0.1 in the binding.

Update: Restarted container, all is well.

Fix

Downloaded certs from NPM.

Fullchain,pem = cert.pem
Permission: 644
Privkey.pem = key.pem
Permission: 600

Disabled Letsencrypted
Verify IP
Verify HTTP

Setup dns as suppose to.

« Previous Page