SSL certifications not working

sheri207

I created a subdomain on my mailcow suppose webmail.example.comand redirected my roundcube traffic to it. It was working fine before. I added the webmail.example.com on mailcow.conf under ADDTIONAL_SAN variable. So it was up and running. Till here no issue.

Unfortunately just to change my roundcube product name, I edited the product_namevariable inside /opt/mailcow-dockerized/data/web/rc/config/defaults.inc.php and now my ssl has stopped working. I ran this command and to check whether my certificates is still valid for webmail.example.com and it is not returning my webmail domain. What should I do? The command is this

openssl x509 -in /opt/mailcow-dockerized/data/assets/ssl/mail.example.com/cert.pem -text -noout | grep -A1 "Subject Alternative Name"

DocFraggle

sheri207 I added the webmail.example.com on mailcow.conf under ADDTIONAL_SAN variable.

Try

docker compose down
docker compose up -d

sheri207

I tried this, but still no effect

So this is what my logs says

acme-mailcow-1  | Sat Mar  8 19:12:17 UTC 2025 - Found A record for webmail.example.com: xx.xx.xxx.xx
acme-mailcow-1  | Sat Mar  8 19:12:17 UTC 2025 - Confirmed A record with IP xx.xx.xxx.xx, but HTTP validation failed

DocFraggle

Did you forget to add this:

location ^~ /.well-known/acme-challenge/ {
    allow all;
    default_type "text/plain";
  }

to your Nginx config?

See https://docs.mailcow.email/manual-guides/Nginx/u_e-nginx_webmail-site/

sheri207

No I have added this piece of code there

server {
    listen 80;
    server_name webmail.example.com;

    return 301 https://$host$request_uri;
}



server {
    ssl_certificate /etc/ssl/mail/mail.example.com/cert.pem;
    ssl_certificate_key /etc/ssl/mail/mail.example.com/key.pem;

    index index.php index.html;
    client_max_body_size 0;
    root /web/rc;  # ✅ Changed root to /web/rc for Roundcube

    include /etc/nginx/conf.d/listen_plain.active;
    include /etc/nginx/conf.d/listen_ssl.active;

#    listen 443 ssl;
    server_name webmail.example.com;
    server_tokens off;

    location ^~ /.well-known/acme-challenge/ {
        allow all;
        default_type "text/plain";
    }

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass php-fpm-mailcow:9000;  # Adjust if needed
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME "$document_root$fastcgi_script_name";
    }
}

DocFraggle

You have to add this to your port 80 config

sheri207

I have changed the nginx conf to this

server {
    listen 80;
    server_name webmail.example.com;

    location ^~ /.well-known/acme-challenge/ {
        allow all;
        default_type "text/plain";
    }
    return 301 https://$host$request_uri;
}



server {
    ssl_certificate /etc/ssl/mail/mail.example.com/cert.pem;
    ssl_certificate_key /etc/ssl/mail/mail.example.com/key.pem;
   
    index index.php index.html;
    client_max_body_size 0;
    root /web/rc;  # ✅ Changed root to /web/rc for Roundcube

    include /etc/nginx/conf.d/listen_plain.active;
    include /etc/nginx/conf.d/listen_ssl.active;

#    listen 443 ssl;
    server_name webmail.example.com;
    server_tokens off;

    location ^~ /.well-known/acme-challenge/ {
        allow all;
        default_type "text/plain";
    }

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass php-fpm-mailcow:9000;  # Adjust if needed
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME "$document_root$fastcgi_script_name";
    }
}

And then tried this

docker compose down
docker compose up -d

But still getting same error

acme-mailcow-1  | Sat Mar  8 20:25:50 UTC 2025 - Found A record for mail.example.com: xx.xx.xx.xx
acme-mailcow-1  | Sat Mar  8 20:25:50 UTC 2025 - Confirmed A record xx.xx.xx.xx
acme-mailcow-1  | Sat Mar  8 20:25:51 UTC 2025 - Found A record for webmail.example.com: xx.xx.xx.xx
acme-mailcow-1  | Sat Mar  8 20:25:51 UTC 2025 - Confirmed A record with IP xx.xx.xx.xx, but HTTP validation failed

My main domain where admin panel is hosted is not failing. Only webmail.example.com is failing

This issue arose when I changed the product_name inside /opt/mailcow-dockerized/data/web/rc/config/defaults.inc.php . Can the issue be because of that? I have reverted my changed product_name to default name which is RoundCube Webmail

DocFraggle

Well, I guess there is something wrong in your config, but I can’t debug it right now.
Why didn’t you adapt the config from

https://docs.mailcow.email/manual-guides/Nginx/u_e-nginx_webmail-site/

and see if it works?

ETNyx

Your problem is chicken egg type,… In your latest config snippet you are redirecting all request from http to https that include validation request, since you have not valid and/or trusted https channel, validation will fail.

So you need to exclude those validation request from being redirected.