ACME SSL for multi doman

kdiamond

Hi.

Coming from Zimbra. There was a single certificate for my 5 domains.

For Mailcow, I’m able to get a certificate for the first domain, which is also a HOSTNAME, but it fails for the other 4 domains.

According to Mailcow DNS checker, I believe my DNS is OK. Green will point to the HOSTMANE domain, not the actual mailbox domain. If I set it to the actual mailbox domain, the mailcow DNS check (Current State column) will show it as not correct.

touch data/assets/ssl/force_renew docker-compose restart acme-mailcow docker-compose logs --tail=200 -f acme-mailcow

After a certificate creation, I only have one folder created.
/opt/mailcow-dockerized/data/assets/ssl/mail.domain1.com
Should there be a separate folder for other domains or only for the hostname domain?

root@mailcow:/opt/mailcow-dockerized# docker-compose logs --tail=200 -f acme-mailcow acme-mailcow-1 | Tue May 27 09:04:21 CEST 2025 - Waiting for Docker API... acme-mailcow-1 | Tue May 27 09:04:21 CEST 2025 - Docker API OK acme-mailcow-1 | Tue May 27 09:04:21 CEST 2025 - Waiting for Postfix... acme-mailcow-1 | Tue May 27 09:04:21 CEST 2025 - Postfix OK acme-mailcow-1 | Tue May 27 09:04:21 CEST 2025 - Waiting for Dovecot... acme-mailcow-1 | Tue May 27 09:04:21 CEST 2025 - Dovecot OK acme-mailcow-1 | Tue May 27 09:04:21 CEST 2025 - Waiting for database... acme-mailcow-1 | Tue May 27 09:04:21 CEST 2025 - Database OK acme-mailcow-1 | Tue May 27 09:04:21 CEST 2025 - Waiting for Nginx... acme-mailcow-1 | Tue May 27 09:04:21 CEST 2025 - Nginx OK acme-mailcow-1 | Tue May 27 09:04:21 CEST 2025 - Waiting for resolver... acme-mailcow-1 | Tue May 27 09:04:23 CEST 2025 - Resolver OK acme-mailcow-1 | Tue May 27 09:04:23 CEST 2025 - Waiting for domain table... acme-mailcow-1 | OK acme-mailcow-1 | Tue May 27 09:04:23 CEST 2025 - Initializing, please wait... acme-mailcow-1 | Could not find certificate from <stdin> acme-mailcow-1 | Could not find certificate from <stdin> acme-mailcow-1 | Tue May 27 09:04:23 CEST 2025 - Using existing domain rsa key /var/lib/acme/acme/key.pem acme-mailcow-1 | Tue May 27 09:04:23 CEST 2025 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem acme-mailcow-1 | Tue May 27 09:04:23 CEST 2025 - No A or AAAA record found for hostname autodiscover.abc123 acme-mailcow-1 | Tue May 27 09:04:23 CEST 2025 - No A or AAAA record found for hostname autoconfig.abc123 acme-mailcow-1 | Tue May 27 09:04:28 CEST 2025 - No A or AAAA record found for hostname autodiscover.domain2.com acme-mailcow-1 | Tue May 27 09:04:28 CEST 2025 - Found A record for autoconfig.domain2.com: 213.250.55.170 acme-mailcow-1 | (skipping check, returning 0) acme-mailcow-1 | Tue May 27 09:04:28 CEST 2025 - Confirmed A record 213.250.55.170 acme-mailcow-1 | Tue May 27 09:04:32 CEST 2025 - No A or AAAA record found for hostname autodiscover.domain4.com acme-mailcow-1 | Tue May 27 09:04:33 CEST 2025 - No A or AAAA record found for hostname autoconfig.domain4.com acme-mailcow-1 | Tue May 27 09:04:34 CEST 2025 - No A or AAAA record found for hostname autodiscover.domain5.com acme-mailcow-1 | Tue May 27 09:04:34 CEST 2025 - No A or AAAA record found for hostname autoconfig.domain5.com acme-mailcow-1 | Tue May 27 09:04:34 CEST 2025 - Found A record for autodiscover.domain1.com: 213.250.55.170 acme-mailcow-1 | (skipping check, returning 0) acme-mailcow-1 | Tue May 27 09:04:34 CEST 2025 - Confirmed A record 213.250.55.170 acme-mailcow-1 | Tue May 27 09:04:35 CEST 2025 - Found A record for autoconfig.domain1.com: 213.250.55.170 acme-mailcow-1 | (skipping check, returning 0) acme-mailcow-1 | Tue May 27 09:04:35 CEST 2025 - Confirmed A record 213.250.55.170 acme-mailcow-1 | Tue May 27 09:04:35 CEST 2025 - No A or AAAA record found for hostname autodiscover.domain3.com acme-mailcow-1 | Tue May 27 09:04:36 CEST 2025 - No A or AAAA record found for hostname autoconfig.domain3.com acme-mailcow-1 | Tue May 27 09:04:36 CEST 2025 - Found A record for mail.domain1.com: 213.250.55.170 acme-mailcow-1 | (skipping check, returning 0) acme-mailcow-1 | Tue May 27 09:04:36 CEST 2025 - Confirmed A record 213.250.55.170 acme-mailcow-1 | Tue May 27 09:04:36 CEST 2025 - Certificate /var/lib/acme/mail.domain1.com/cert.pem missing or changed domains 'mail.domain1.com autoconfig.domain2.com autoconfig.domain1.com autodiscover.domain1.com' - start obtaining acme-mailcow-1 | Tue May 27 09:04:36 CEST 2025 - Creating backups in /var/lib/acme/backups/mail.domain1.com/2025-05-27_09_04_36 ... acme-mailcow-1 | Tue May 27 09:04:36 CEST 2025 - Checking resolver... acme-mailcow-1 | Tue May 27 09:04:36 CEST 2025 - Resolver OK acme-mailcow-1 | Tue May 27 09:04:36 CEST 2025 - Using command acme-tiny --account-key /var/lib/acme/acme/account.pem --disable-check --csr /var/lib/acme/mail.domain1.com/acme.csr --acme-dir /var/www/acme/ acme-mailcow-1 | Parsing account key... acme-mailcow-1 | Parsing CSR... acme-mailcow-1 | Found domains: mail.domain1.com, autoconfig.domain2.com, autoconfig.domain1.com, autodiscover.domain1.com acme-mailcow-1 | Getting directory... acme-mailcow-1 | Directory found! acme-mailcow-1 | Registering account... acme-mailcow-1 | Already registered! Account ID: https://acme-v02.api.letsencrypt.org/acme/acct/2418718437 acme-mailcow-1 | Creating new order... acme-mailcow-1 | Order created! acme-mailcow-1 | Already verified: autoconfig.domain2.com, skipping... acme-mailcow-1 | Already verified: autoconfig.domain1.com, skipping... acme-mailcow-1 | Already verified: autodiscover.domain1.com, skipping... acme-mailcow-1 | Already verified: mail.domain1.com, skipping... acme-mailcow-1 | Signing certificate... acme-mailcow-1 | Certificate signed! acme-mailcow-1 | Tue May 27 09:04:52 CEST 2025 - Deploying certificate /var/lib/acme/mail.domain1.com/cert.pem... acme-mailcow-1 | Tue May 27 09:04:52 CEST 2025 - Verified hashes. acme-mailcow-1 | Tue May 27 09:04:52 CEST 2025 - Certificate successfully obtained acme-mailcow-1 | Tue May 27 09:04:52 CEST 2025 - Reloading or restarting services... (1) acme-mailcow-1 | Reloading Nginx... acme-mailcow-1 | Restarting cb62279e62ff0727a8e36baf331aecfc45e27c7d07e4fa6d93263b6f695d60b6... acme-mailcow-1 | command completed successfully acme-mailcow-1 | Restarting ccb9da3d9c602ddc66e4e1a36e13bd2eb7bf2a53298c5e145fb82e10b53f71d6... acme-mailcow-1 | command completed successfully acme-mailcow-1 | Tue May 27 09:04:57 CEST 2025 - Waiting for containers to settle... acme-mailcow-1 | Tue May 27 09:05:07 CEST 2025 - Certificates were successfully renewed where required, sleeping for another day.
Logs seem fine, but GUI for second domain is still unsecured.

Thank you for your help!

kdiamond

Hi.

Reading the advanced SSL docs, I just found out about ADDITIONAL_SAN= and ADDITIONAL_SERVER_NAMES= settings

ADDITIONAL_SAN=mail.domain2.com,mail.domain3.com,mail.domain4.com,mail.domain5.com
ADDITIONAL_SERVER_NAMES=mail.domain2.com,mail.domain3.com,mail.domain4.com,mail.domain5.com

Is this the correct setting for additional domains?

Thank you

esackbauer

yes. Maybe you want to include mail.* autoconfig.* and autodiscover.* instead of using the domains. It will then use the domains configured in mailcow.
https://docs.mailcow.email/post_installation/firststeps-ssl/#additional-domain-names

kdiamond

esackbauer

Thank you for your reply.

I’m now exactly sure I understand it entirely.

ADDITIONAL_SAN=mail.*,autoconfig.*,autodiscover.*
ADDITIONAL_SERVER_NAMES=mail.*,autoconfig.*,autodiscover.*

Is this what you are suggesting?

Thank you

esackbauer

https://docs.mailcow.email/post_installation/reverse-proxy/r_p/?h=additional_server_n#adding-additional-server-names-for-mailcow-ui
Wildcard not working for ADDITIONAL_SERVER_NAMES. This parameter is for accessing the GUI.

kdiamond

esackbauer

OK
ADDITIONAL_SAN=mail.*,autoconfig.*,autodiscover.*

Are you suggesting to leave ADDITIONAL_SERVER_NAMES= empty, or like this:
ADDITIONAL_SERVER_NAMES=mail.domain2.com,mail.domain3.com,mail.domain4.com,mail.domain5.com

Thank you

esackbauer

As its written in the documentation, use
ADDITIONAL_SERVER_NAMES=mail.domain2.com,mail.domain3.com,mail.domain4.com,mail.domain5.com

kdiamond

Second, a bit off-topic question.

Of course, I hit the Let’s Encrypt limit and now I have to wait…

retry after 2025-05-28 18:05:53 UTC: see https://letsencrypt.org/docs/rate-limits/#new-certificates-per-exact-set-of-hostnames', 'status': 429

I remember there was a way around it by adding a false domain, tricking it to create a new certificate.

Any ideas?

Thank you