net::ERR_CERT_COMMON_NAME_INVALID please help.

kdiamond

Hi.

I currently have five domains on my MailCow server.

One of the domains SSL is not working and I can not find the reason. All certificates are generated by Mailcow ACME without error. Can anyone help me?

Thank you

Those are my settings in the mailcow.conf.

Maybe the problem is here:

ADDITIONAL_SAN=mail.*,autoconfig.*,autodiscover.* ADDITIONAL_SERVER_NAMES=mail.domain1.com,mail.domain2.si,mail.domain13.com

Thank you

kdiamond

I found the problem.

Checking the certificate with the SSL Server test

Alternative names are flooded with autoconfig and autodiscover prefixes.

On my Zimbra mail server, the certificate’s Alternative names are simply mail.*

So how to remove autoconfig and autodiscover domains from Certificate.

I changed mailcow conf:
ADDITIONAL_SAN=mail.*

forced new certificate:
cd /opt/mailcow-dockerized touch data/assets/ssl/force_renew docker-compose restart acme-mailcow docker-compose logs --tail=200 -f acme-mailcow

I recreated the certificate, alternative names are still there.

Any ideas?

Thank you

ETNyx

Hello, my guess is: You have AUTODISCOVER_SAN directive set to y and this directive keep autodiscover and autoconfig subdomains in alternative names for your cert (git).

kdiamond

Hi. Thank you for your reply.

My autodiscover setting is ADDITIONAL_SAN=mail.*, but the certificate still contains autodiscover and autoconfig names.

I guess only mail.* domains should be there.

Thx

ETNyx

I’m not talking about ADDITIONAL_SAN, please read my post once agian,..

kdiamond

Ahh, yes, I overlooked it. Sorry

The line was missing 🙂 Maybe I deleted it by mistake.

I set it now forAUTODISCOVER_SAN=y I don’t know what is default setting.

So, before I go and make this change. Is there any benefit to having autodiscover and autoconfig names in the certificate,of I can simply set it to N?

Thank you for an explanation.

I set it to AUTODISCOVER_SAN=n and I got exactly what I needed.

Thank you so much!!!!

I marked the wrong best answer. Now I can edit my posts for some reason.

Anyway, thank you @[deleted] !!!!

Br,

ETNyx

kdiamond I set it now forAUTODISCOVER_SAN=y I don’t know what is default setting.

Default config is y see this for additional info

kdiamond So, before I go and make this change. Is there any benefit to having autodiscover and autoconfig names in the certificate,of I can simply set it to N?

That depend on client, if client use auto-discovery feature than maybe and if client enforce ssl than definetly and auto-discovery will not work

kdiamond Thank you so much!!!!

Happy to help :-)