MTA-STS Reverse Proxy

ETNyx

please use insert code properly

code
code

This way I do not know what is your error and what was changed by forum,… for example

ServerAlias autodiscover.

is invalid

mlcwuser

Please use code blocks for your configs, otherwise, they are hard to read.

Also, you need to make sure that the mta-sts.txt file is served under:

https://mta-sts.yourdomain.tld/.well-known/mta-sts.txt

The URL/path must be exactly like this; otherwise, it won’t work.

Whether the file is served by Mailcow’s NGINX or by Apache shouldn’t matter, as long as it is served from the same server as Mailcow.

[unknown]

More important than which web server serves the file is that…

The URL/path under which the file is served looks exactly like the one I posted earlier.
The content of the file is correct.
The DNS records are set up correctly.

Make sure to read this:
https://support.google.com/a/answer/9261504?hl=en

…and also these for examples:
https://return2.net/mail-security-mta-sts-mailcow/
https://schroederdennis.de/tutorial-howto/mailcow-mta-sts-richtig-einrichten-security-mit-tls/ (German)

jh537

gleisnetzede.txt

2kB

I’m sorry, the formatting didn’t work. Does this help as an attachment? I have checked the paths.

[unknown] I followed Schröderdennis’ instructions exactly. The DNS entries have been running for more than 24 hours.

[unknown]

I followed Schröderdennis’ instructions exactly. The DNS entries have been running for more than 24 hours.

I followed Schroederdennis’ instructions exactly. The DNS entries have been running for more than 24 hours.

mlcwuser

If Mailcow is running on the same server as Apache, I would try to serve it via a separte VirtualHost directly from Apache:

Put your mta-sts-txt file e.g. here:

/var/www/mta-sts/.well-known/mta-sts.txt

Make sure Apache can read the file:

chown -R www-data:www-data /var/www/mta-sts

Create a VirtualHost:

Example:

<VirtualHost *:443>
ServerName mta-sts.yourdomain.tld
DocumentRoot /var/www/mta-sts

RewriteEngine On
RewriteOptions IgnoreInherit
RewriteRule !^/.well-known/mta-sts.txt - [L,R=403]

SSLEngine On
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile  /etc/letsencrypt/live/mta-sts.yourdomain.tld/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mta-sts.yourdomain.tld/privkey.pem
</VirtualHost>

ETNyx

Ok, my guess you need to adjust your ServerAlias there,

<VirtualHost *:443>
  ServerName h1.gleisnetze.de
  ServerAlias autodiscover.*
  ServerAlias autoconfig.*

<VirtualHost *:443>
  ServerName h1.gleisnetze.de
  ServerAlias autodiscover.*
  ServerAlias autoconfig.*
  ServerAlias mta-sts.*

what address you are expecting to get this file exactly? This one is available https://h1.gleisnetze.de/.well-known/mta-sts.txt

jh537

ETNyx https://mta-sts.gleisnetze.de/.well-known/mta-sts.txt

[unknown] Does Acme then also realise that it has to obtain the certificates?

@“mlcwuser” #p26494 Does Acme then also realise that it has to obtain the certificates?

mlcwuser

jh537 @“mlcwuser” #p26494 Does Acme then also realise that it has to obtain the certificates?

No they would then have tob obtained via Apache. If you want Mailcow to manage the certificates, then I don’t know how the exact Apache directives would look like, but either way, the mta-sts subdomain needs to be added to the Apache config.

mlcwuser

jh537 I would recommend managing all subdomains and certificates via Apache, and then also using these certificates in Mailcow, instead of the other way around. That should make many things easier ;-)

ETNyx

Ok than ServerAlias mta-sts.* should work, you can be more specific ServerAlias mta-sts.gleisnetze.de

Also you will need to modify your mailcow config to cover this under cert using ADDITIONAL_SERVER_NAMES=mta-sts.gleisnetze.de in mailcow.conf

ETNyx

Uff, while you are using proxy you are not getting cert from MC ACME right? Than you need to modify your system,…

jh537

acme-mailcow-1  | Parsing account key...
acme-mailcow-1  | Parsing CSR...
acme-mailcow-1  | Found domains: autodiscover.domain.de, mta-sts.domain.de, h1.domain.de, autoconfig.domain.de
acme-mailcow-1  | Getting directory...
acme-mailcow-1  | Directory found!
acme-mailcow-1  | Registering account...
acme-mailcow-1  | Already registered! Account ID: https://acme-v02.api.letsencrypt.org/acme/acct/1050350447
acme-mailcow-1  | Creating new order...
acme-mailcow-1  | Order created!
acme-mailcow-1  | Already verified: autoconfig.domain.de, skipping...
acme-mailcow-1  | Already verified: autodiscover.domain.de, skipping...
acme-mailcow-1  | Already verified: h1.domain.de, skipping...
acme-mailcow-1  | Verifying mta-sts.domain.de...
acme-mailcow-1  | mta-sts.domain.de verified!
acme-mailcow-1  | Signing certificate...
acme-mailcow-1  | Certificate signed!
acme-mailcow-1  | Mon Aug 11 12:46:58 CEST 2025 - Deploying certificate /var/lib/acme/h1.domain.de/cert.pem...
acme-mailcow-1  | Mon Aug 11 12:46:58 CEST 2025 - Verified hashes.
acme-mailcow-1  | Mon Aug 11 12:46:58 CEST 2025 - Certificate successfully obtained
acme-mailcow-1  | Mon Aug 11 12:46:58 CEST 2025 - Reloading or restarting services... (1)
acme-mailcow-1  | Reloading Nginx...
acme-mailcow-1  | Restarting fd9210eb54bfdb996a61d871ab927ab716cd673fbb721300301c06c2391e17ea...
acme-mailcow-1  | command completed successfully
acme-mailcow-1  | Restarting d9225a7d565d53e094adee8e4f160614cb04a6fe7d4ae41349c6e2c44e318577...
acme-mailcow-1  | command completed successfully
acme-mailcow-1  | Mon Aug 11 12:47:06 CEST 2025 - Waiting for containers to settle...
acme-mailcow-1  | Mon Aug 11 12:47:16 CEST 2025 - Certificates were successfully renewed where required, sleeping for another day.

ServerAlias mta-sts.domain.de
It helped, the certificate was generated but not yet properly connected. The file has already been found. Now I just need to connect the certificate files in apache.conf, which I should be able to do.

//EDIT by @pkernstock: Removed domain as per authors request.

jh537

jh537
[IMAGE REMOVED]

Unfortunately, I cannot find any other certificate generated for mta*.

You guys are the best. I used ServerAlias mta-sts.* and it recognised the certificate.

[IMAGE REMOVED]

Thank you very much!!!

//EDIT by @pkernstock Removed images on request as domain could be seen

mlcwuser

Although manging everything via Apache, is probably not ideal either, and the documentation seems to recommend otherwise: https://docs.mailcow.email/post_installation/reverse-proxy/r_p/#adding-additional-server-names-for-mailcow-ui

Well then, since everything else is working, you have two options: Try to adjust MTA-STS according to the same principle as the rest (autodiscover, etc.) so that it works with the correct URL/path. It’s certainly possible, but I can’t help with that. ;-)

Or you leave everything else as it is, and simply serve (only) MTA-STS from Apache instead of from Mailcow, and obtain these certificates via Apache. That shouldn’t be a problem, since MTA-STS is, at the end of the day, just another website served by this server, which only consists of a single text file.

jh537

I would like to remove/anonymise the domain names. Is that possible? Or can an admin do that?

DocFraggle

@pkernstock could do that

pkernstock

I removed the images.