Let's Encrypt Problem

osloasn

acme-mailcow-1 | Mon Apr 14 12:58:48 CDT 2025 - Initializing, please wait…
acme-mailcow-1 | Could not find certificate from <stdin>
acme-mailcow-1 | Could not find certificate from <stdin>
acme-mailcow-1 | Mon Apr 14 12:58:48 CDT 2025 - Using existing domain rsa key /var/lib/acme/acme/key.pem
acme-mailcow-1 | Mon Apr 14 12:58:48 CDT 2025 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem
acme-mailcow-1 | Mon Apr 14 12:58:48 CDT 2025 - Detecting IP addresses…
acme-mailcow-1 | Mon Apr 14 12:58:58 CDT 2025 - OK: 76.243.8.186, 0000:0000:0000:0000:0000:0000:0000:0000
acme-mailcow-1 | Mon Apr 14 12:58:58 CDT 2025 - Found A record for mail.lldmusatech.net: 76.243.8.186
acme-mailcow-1 | Mon Apr 14 13:01:09 CDT 2025 - Confirmed A record with IP 76.243.8.186, but HTTP validation failed
acme-mailcow-1 | Mon Apr 14 13:01:09 CDT 2025 - Cannot validate any hostnames, skipping Let’s Encrypt for 1 hour.
acme-mailcow-1 | Mon Apr 14 13:01:09 CDT 2025 - Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently.

I do notice the acme challenge directory is empty
root@mail:/opt/mailcow-dockerized# ls -lat data/web/.well-known/acme-challenge/

Doing these steps does help create the file, but it still doesn’t want to issue the certificate.
1. docker compose down
2. Reboot the server
3. docker compose up -d

root@mail:/opt/mailcow-dockerized# ls -lat data/web/.well-known/acme-challenge/
total 12
drwxr-xr-x 2 root root 4096 Apr 14 13:31 .
-rw-r–r– 1 root root 15 Apr 14 13:31 45242817123797
drwxr-xr-x 3 root root 4096 Apr 14 11:42 ..

acme-mailcow-1 | Mon Apr 14 13:31:07 CDT 2025 - Initializing, please wait…
acme-mailcow-1 | Could not find certificate from <stdin>
acme-mailcow-1 | Could not find certificate from <stdin>
acme-mailcow-1 | Mon Apr 14 13:31:07 CDT 2025 - Using existing domain rsa key /var/lib/acme/acme/key.pem
acme-mailcow-1 | Mon Apr 14 13:31:07 CDT 2025 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem
acme-mailcow-1 | Mon Apr 14 13:31:07 CDT 2025 - Detecting IP addresses…
acme-mailcow-1 | Mon Apr 14 13:31:17 CDT 2025 - OK: 76.243.8.186, 0000:0000:0000:0000:0000:0000:0000:0000
acme-mailcow-1 | Mon Apr 14 13:31:17 CDT 2025 - Found A record for mail.lldmusatech.net: 76.243.8.186
acme-mailcow-1 | Mon Apr 14 13:33:28 CDT 2025 - Confirmed A record with IP 76.243.8.186, but HTTP validation failed
acme-mailcow-1 | Mon Apr 14 13:33:28 CDT 2025 - Cannot validate any hostnames, skipping Let’s Encrypt for 1 hour.
acme-mailcow-1 | Mon Apr 14 13:33:28 CDT 2025 - Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently.
acme-mailcow-1 | OK

DocFraggle

Check if port 80 incoming is blocked. It’s needed for the validation

osloasn

I have configured it and confirmed that it is functioning. I can access the site using ports 80 and 443.

I just noticed that the file created earlier inside the acme challenge directory is gone.

root@mail:/opt/mailcow-dockerized# ls -lat data/web/.well-known/acme-challenge/
total 8
drwxr-xr-x 2 root root 4096 Apr 14 13:33 .
drwxr-xr-x 3 root root 4096 Apr 14 11:42 ..

I just noticed that the file created earlier inside the acme challenge directory is gone.

root@mail:/opt/mailcow-dockerized# ls -lat data/web/.well-known/acme-challenge/
total 8
drwxr-xr-x 2 root root 4096 Apr 14 13:33 .
drwxr-xr-x 3 root root 4096 Apr 14 11:42 ..

I just noticed that the file created earlier inside the acme challenge directory is gone.

root@mail:/opt/mailcow-dockerized# ls -lat data/web/.well-known/acme-challenge/
total 8
drwxr-xr-x 2 root root 4096 Apr 14 13:33 .
drwxr-xr-x 3 root root 4096 Apr 14 11:42 ..

I apologize for the triple post. I’m new to the community.

DocFraggle

osloasn I have configured it and confirmed that it is functioning. I can access the site using ports 80 and 443

To clarify: did you configure http after I asked if it’s enabled? Or was it already enabled?

DocFraggle

Is it a standard setup or are you using a reverse proxy?

osloasn

It is a standard setup.

osloasn

It was already enabled. I’ve been dealing with these issues for days.

DocFraggle

Ok, really strange… it’s all checking out ok in my eyes… DNS ok, http ok, Nginx responding for test URL

http://mail.lldmusatech.net/.well-known/acme-challenge/x

Any host or external firewall which may block Letsencrypt?

osloasn

None.

DocFraggle

Then I’m out of ideas… I guess you already tried restarting the stack it rebooting the server?

osloasn

Yes, I did.

It could be IPv6 that is causing it. I’m following the steps using this URL, but I’m stuck at the last step. I’m not able to find DISABLE_IPv6

https://docs.mailcow.email/post_installation/firststeps-disable_ipv6/

Disable IPv6 listeners for NGINX

Set DISABLE_IPv6=y in mailcow.conf

DocFraggle

osloasn Set DISABLE_IPv6=y in mailcow.conf

I guess this line is meant to be added to your mailcow.conf file.

But I doubt that your problem is based on IPv6, as it’s trying to validate the IPv4 address

osloasn

The internal Docker service is trying to communicate using IPv6. I know this because, when looking at the queue manager, the recipients column shows IPv6 being used (uploaded image).

FYI - I bypassed the HTTP verification.

DocFraggle

osloasn The internal Docker service is trying to communicate using IPv6.

So? This has absolutely nothing to do with the verification of an A record (=IPv4)

osloasn

Understood.

What I’m trying to say is that the service inside the Docker network environment is trying to use IPv6 instead of IPv4.