I use mailcow behind NPM (nginx-proxy-manager) and I had this same problem two days ago. I’m going to write the solution I did for my case, which might help you find your specific problem.
INTRODUCTION
After the certificates for the receiving and sending protocols expired, the email managers lost communication with the server and the following error appeared in the mailcow-postfix logs:
TLS library problem: error:0A000416:SSL routines::sslv3 alert certificate unknown:../ssl/record/rec_layer_s3.c:1605:SSL alert numb
After a lot of research, I discovered that the problem wasn’t the firewall, DNS or many other suggestions from the forums. In fact, the problem was that I needed to use the reverse proxy certificates in mailcow.
SOLUTION
The problem is between the reverse proxy and the Let’s Encrypt certificate.
IMPORTANT:
a. Before performing the procedures, make a backup;
b. Perform a ‘docker-compose down’. This should be done before changing the certificate files and changing mailcow.conf (if necessary);
c. After the procedure, perform a ‘docker-compose up -d’.
- Create a certificate with the name mail.domain.com and download this certificate from the NPM SSL menu.
- After downloading, you need to copy the cert3.pem file to cert.pem and privkey3.pem to key.pem in the /opt/mailcow-dockerized/data/assets/ssl folder, replacing the ones that are already there. 3. In the mailcow.conf file in the /opt/mailcow-dockerized directory, set HTTP-PORT to 8080, or any port you don’t already use, HTTP_BIND to 127.0.0.1, HTTPS-PORT to 8443, or another port number that isn’t already in use, and HTTPS_BIND to 127.0.0.1.
- In NPM, set the ‘Target’ to the name of the Docker container (mailcowdockerized-nginx-mailcow-1) or the IP address of the container, and the port number to 8443 (HTTPS-PORT in mailcow.conf), block common exploits, set Websockets-support to enabled, set the SSL certificate, and force SSL on the SSL page.
- You must place the mailcowdockerized-nginx-mailcow-1 container on the same network as ngix-proxy-manager. Leave them on both networks.
The certificates should work again.
