Confirmed A record with IP x.x.x.x, but HTTP validation failed

SirSlarti

Hi,
So I trying to get real certificates, but somehow, the mailcow internal is not acting as I would like to.
All DNS is set, mail-tester.com score is 9,5.

dns has as well the autodiscover configured. So in the end the log says:

acme-mailcow-1  | Tue Dec 31 12:11:04 CET 2024 - Found A record for my.mailersname.com: x.x.x.x
acme-mailcow-1  | Tue Dec 31 12:11:04 CET 2024 - Confirmed A record with IP x.x.x.x, but HTTP validation failed
acme-mailcow-1  | Tue Dec 31 12:11:04 CET 2024 - Cannot validate any hostnames, skipping Let's Encrypt for 1 hour.
acme-mailcow-1  | Tue Dec 31 12:11:04 CET 2024 - Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently.

What can I do?
Thanks a lot in advance.
Slarti

DocFraggle

SirSlarti but HTTP validation failed

Do you still get this message? Then it still doesn’t work

DocFraggle

Port 80 is not reachable on your server

SirSlarti

DocFraggle thanks for the fast reply. 80 is reachable. I am on the web interface, I can use the web client. … oh wait … port 80 is redirected on another server (proxy-forward … l forgot) so … I will investigate.

SirSlarti

DocFraggle . I forwarded all traffic to the server, still the same. Anything else?

DocFraggle

Do you get an answer from nginx like this:

http://demo.mailcow.email/.well-known/

SirSlarti

DocFraggle No everything works, I just want a nice cert and not a self-signed.

SirSlarti

DocFraggle oh wow. Ok everything else, besides why I am posting works.

more digging:

nginx-mailcow-1    | 207.244.229.40 - - [01/Jan/2025:05:09:03 +0100] "GET /.well-known/acme-challenge/F3_CJMG7G5Z88BFSQ-SA7M5LK4B7I_ZT HTTP/1.1" 404 146 "-" "Cpanel-HTTP-Client/1.0"
nginx-mailcow-1    | 2025/01/01 05:09:03 [error] 23#23: *12869 open() "/web/.well-known/acme-challenge/F3_CJMG7G5Z88BFSQ-SA7M5LK4B7I_ZT" failed (2: No such file or directory), client: 207.244.229.40, server: my-mailer.my-domain.net, request: "GET /.well-known/acme-challenge/F3_CJMG7G5Z88BFSQ-SA7M5LK4B7I_ZT HTTP/1.1", host: "my-domain.com"
nginx-mailcow-1    | 207.244.229.40 - - [01/Jan/2025:05:09:03 +0100] "GET /.well-known/acme-challenge/73Z15SD77I53Q3NN06V_SPQHGB9-8ZXM HTTP/1.1" 404 146 "-" "Cpanel-HTTP-Client/1.0"
nginx-mailcow-1    | 2025/01/01 05:09:03 [error] 23#23: *12870 open() "/web/.well-known/acme-challenge/73Z15SD77I53Q3NN06V_SPQHGB9-8ZXM" failed (2: No such file or directory), client: 207.244.229.40, server: my-mailer.my-domain.net, request: "GET /.well-known/acme-challenge/73Z15SD77I53Q3NN06V_SPQHGB9-8ZXM HTTP/1.1", host: "www.my-domain.com"

Here: my-mailer.my-domain.net is right, but then it asks 2 times one time for my-domain.com (wrong as it is .net) and one time for www.my-domain.com (which is wrong as well). : scratch head

more digging:

nginx-mailcow-1    | 207.244.229.40 - - [01/Jan/2025:05:09:03 +0100] "GET /.well-known/acme-challenge/F3_CJMG7G5Z88BFSQ-SA7M5LK4B7I_ZT HTTP/1.1" 404 146 "-" "Cpanel-HTTP-Client/1.0"
nginx-mailcow-1    | 2025/01/01 05:09:03 [error] 23#23: *12869 open() "/web/.well-known/acme-challenge/F3_CJMG7G5Z88BFSQ-SA7M5LK4B7I_ZT" failed (2: No such file or directory), client: 207.244.229.40, server: my-mailer.my-domain.net, request: "GET /.well-known/acme-challenge/F3_CJMG7G5Z88BFSQ-SA7M5LK4B7I_ZT HTTP/1.1", host: "my-domain.com"
nginx-mailcow-1    | 207.244.229.40 - - [01/Jan/2025:05:09:03 +0100] "GET /.well-known/acme-challenge/73Z15SD77I53Q3NN06V_SPQHGB9-8ZXM HTTP/1.1" 404 146 "-" "Cpanel-HTTP-Client/1.0"
nginx-mailcow-1    | 2025/01/01 05:09:03 [error] 23#23: *12870 open() "/web/.well-known/acme-challenge/73Z15SD77I53Q3NN06V_SPQHGB9-8ZXM" failed (2: No such file or directory), client: 207.244.229.40, server: my-mailer.my-domain.net, request: "GET /.well-known/acme-challenge/73Z15SD77I53Q3NN06V_SPQHGB9-8ZXM HTTP/1.1", host: "www.my-domain.com"

Here: my-mailer.my-domain.net is right, but then it asks 2 times one time for my-domain.com (wrong as it is .net) and one time for www.my-domain.com (which is wrong as well). : scratch head

SirSlarti

Well, I found a solution to my problem, because after all these testing, I knew it should work, but the HTTP validation failed again and again. So I looked into the script.

I started the docker acme

and went into:
cd /srv vi acme.sh

and added before the source call of functions.sh this:

SKIP_HTTP_VERIFICATION=yes

restarted acme again and it got my certificates.
Have in mind that after an update, this might be needed to be repeated unless there is another way.