Mailcow Lets Encrypt

Amrit

Ok lets Encrypt expired on May 6th for mailcow trying to debug this issue. So the docker service that runs for the cert is acme-mailcow and reading some similar discussions i just have to restart. But didn’t work. Doing nmap from the outside port 80 is closed but firewall rules are good for http. Doing sudo ss -tulnp | grep :80 returns nothing. So I dont think anything is even listening in port 80, I think you need that for certbot, I am not sure about what is wrong here. Here are some logs from acme-mailcow -

Wed May 14 00:51:17 UTC 2025 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem
acme-mailcow-1 | Wed May 14 00:51:17 UTC 2025 - Detecting IP addresses…
acme-mailcow-1 | Wed May 14 00:51:19 UTC 2025 - OK: 172.172.172.172, 2a01:2a01::2a01:2a01:2a01:2a01
acme-mailcow-1 | Wed May 14 00:51:19 UTC 2025 - Found AAAA record for autodiscover.domain.com: 2a01:2a01::2a01:2a01:2a01:2a01 - skipping A record check
acme-mailcow-1 | Wed May 14 00:51:19 UTC 2025 - Confirmed AAAA record with IP 2a01:2a01::2a01:2a01:2a01:2a01, but HTTP validation failed
acme-mailcow-1 | Wed May 14 00:51:19 UTC 2025 - Found AAAA record for autoconfig.domain.com: 2a01:2a01::2a01:2a01:2a01:2a01 - skipping A record check
acme-mailcow-1 | Wed May 14 00:51:19 UTC 2025 - Confirmed AAAA record with IP 2a01:2a01:2a01:2a01:2a01:2a01:2a01:2a01, but HTTP validation failed
acme-mailcow-1 | Wed May 14 00:51:19 UTC 2025 - Cannot validate any hostnames, skipping Let’s Encrypt for 1 hour.
acme-mailcow-1 | Wed May 14 00:51:19 UTC 2025 - Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently.

looks like http is failing but im not sure why, i havn’t changed anything in my mailcow.conf

DocFraggle

Amrit looks like http is failing but im not sure why

You just wrote it yourself:

Amrit Doing nmap from the outside port 80 is closed but firewall rules are good for http

You have to debug why it is closed. Do you have an extra firewall like firewalld or ufw running on your host? If yes, disable it completly, restart the mailcow stack (docker compose down && docker compose up -d) and try again

Amrit

I belive it is only appearing closed - i started a http server on port 80 and it worked. i already tried that docker compose, docker system prune etc. nginx mailcow container seems that it is only listening on port 443, here is my mailcow.conf file,
MAILCOW_HOSTNAME=example.com

MAILCOW_PASS_SCHEME=BLF-CRYPT

DBNAME=mailcowdb
DBUSER=mailcowuser
DBPASS=StrongDBPassword
DBROOT=StrongRootPassword

REDISPASS=StrongRedisPassword

HTTP_PORT=80
HTTP_BIND=

HTTPS_PORT=443
HTTPS_BIND=

HTTP_REDIRECT=n

SMTP_PORT=25
SMTPS_PORT=465
SUBMISSION_PORT=587
IMAP_PORT=143
IMAPS_PORT=993
POP_PORT=110
POPS_PORT=995
SIEVE_PORT=4190
DOVEADM_PORT=127.0.0.1:19991
SQL_PORT=127.0.0.1:13306
REDIS_PORT=127.0.0.1:7654

TZ=UTC

COMPOSE_PROJECT_NAME=mailcowdockerized

DOCKER_COMPOSE_VERSION=native

ACL_ANYONE=disallow

MAILDIR_GC_TIME=7200

ADDITIONAL_SAN=

ADDITIONAL_SERVER_NAMES=

SKIP_LETS_ENCRYPT=n

ENABLE_SSL_SNI=n

SKIP_IP_CHECK=n

SKIP_HTTP_VERIFICATION=n

SKIP_UNBOUND_HEALTHCHECK=n

SKIP_CLAMD=y

SKIP_SOGO=n

SKIP_FTS=n

FTS_HEAP=128

FTS_PROCS=1

ALLOW_ADMIN_EMAIL_LOGIN=n

USE_WATCHDOG=y