ACME Cert Alternative Names mismatch

kdiamond

Hi.

Every few days, my certificate fails. I have to force renew it manually and it’s OK for the next couple of days.

My DNS seems OK for all domains

Here is my mailcow.conf settings.

ADDITIONAL_SAN=mail.*
AUTODISCOVER_SAN=n

What could be the case?

By the way. Is it advised to set AUTODISCOVER_SAN=Y to add 2 Alternative names for each domain (autodiscover.ADDED_MAIL_DOMAIN and autoconfig.ADDED_MAIL_DOMAIN)?

That means for 5 domains I will get 15 Alternative names entries in my certificate? It that OK?

Thank you

ETNyx

kdiamond By the way. Is it advised to set AUTODISCOVER_SAN=Y to add 2 Alternative names for each domain (autodiscover.ADDED_MAIL_DOMAIN and autoconfig.ADDED_MAIL_DOMAIN)?

Yes, they are used by MC and mail clients.

kdiamond That means for 5 domains I will get 15 Alternative names entries in my certificate? It that OK?

MC use LE, LE have 100 hostnames limit, you are fine until this limit is reached.

kdiamond What could be the case?

Any chance to disclose your fdqn to make own checks?

kdiamond

Thank you for your reply @ETNyx .

Yes, I enabled AUTODISCOVER_SAN=Y

I also discovered that I had commented #ADDITIONAL_SAN=mail.* by mistake, so that might be the issue alone.

My main domain is the mail.globelocalize.com. You can check, but it’s fine now. I can see a DNS CAA is missing. Would you recommend adding this too?

Thank you
Br