Autodiscover Generates a Trust Warning - Certificate Generated by Mailcow

theprez1980

Hey All -

As an example, I’ve setup Mailcow using mail.domain.com, I’m able to access mail.domain.com fine, e-mails work, and the checkmarks are all green when verifying DNS records from within the admin panel.

However, when setting up an iOS mobile device, using Exchange (ActiveSync) - it complains about the SSL certificate not being trusted. Upon closer inspection, it seems its because the certificate managed by MailCow doesn’t have “autodiscover.domain.com” as a SAN. Is this by design or is something somewhere configured incorrectly? I was able to mark “Trust” on the device, and it all works fine - but it seems like something is off.

Just to recap, autodiscover is a CNAME to mail.domain.com and it’s passed the verification as it has the green checkmark.

Any ideas? Thanks

ETNyx

theprez1980 Is this by design or is something somewhere configured incorrectly?

Something is wrong, MC by default add autoconfig and autodiscover subdomain as SAN for all tracked domain. Start search your logs.

From docs:
`For each domain you add, it will try to resolve autodiscover.ADDED_MAIL_DOMAIN and autoconfig.ADDED_MAIL_DOMAIN to its IPv6 address or - if IPv6 is not configured in your domain - IPv4 address. If it succeeds, a name will be added as SAN to the certificate request.

Only names that can be validated, will be added as SAN.

For every domain you remove, the certificate will be moved and a new certificate will be requested. It is not possible to keep domains in a certificate, when we are not able validate the challenge for those.`

theprez1980

ETNyx

Thanks for the reply, looks like bringing docker down and restarting it fixed the issue. Not sure what occured, but I now see the SANs present on the certificate.

Thanks