NginxProxyManager + Mailcow : Question about certs..

hokydok

Hi Everyone,
French guy here so apologies for mistakes that could be made..
First time using mailcow, what a great project !
Maybe question has been asked before but let me explain :

I’ve got a self hosted server at home ( dockerized version )
domain name at OVH : everything is setted up in DNS, dkim, spf, dmarc, “mail. autoconfig. autodiscover.” etc, all works fine. Reverse DNS also fine with my ISP.
NPM docker which grab the letsencrypt certs (autoconfig. autodiscover. mail.) and goes toward proxy host mailcow in https
Mailcow docker installed without acme container (disabled letsencrypt)

As the doc said, I’ve copied the certs to “/opt/mailcow-dockerized/data/assets/ssl/”
=> https://docs.mailcow.email/post_installation/reverse-proxy/r_p/#important-information-please-read-them-carefully

Litteraly everything works fine.

Access to https://mail.domain.tld/ as admin or user
sending and receiving is working well, got a 10/10 on https://www.mail-tester.com/ ( so proud of me ! 🙂 )

The only problem I got is when I try to add the mailbox on my android phone, I’ve got a bad cert error
I really don’t know what I’ve missed, or what I should do… where to check also.. !

I’ve seen somewhere in the forum to check my certs with the command :

openssl x509 -text -noout -in data/assets/ssl/cert.pem | grep DNS | sed -e ‘s/,/\n/g’ | awk -F: ‘{print $2}’ | sort
and they’re fine…

Well… Someone could light me up on this ?
Thanks a lot !

ETNyx

You are not providing enough information.

Did you follow docs as it state copy fullchain to cert? This is usually misread and not done correctly, than it produce error as you describe.

hokydok

Hi, thx for the reply

You are talking about “Optional: Post-hook script for non-mailcow ACME clients” ?
with the example script :
#!/bin/bash cp /etc/letsencrypt/live/my.domain.tld/fullchain.pem /opt/mailcow-dockerized/data/assets/ssl/cert.pem etc......

Yeah I’ve done that, and I’ve checked with the openssl command I gave earlyer that gave me the right thing :
autoconfig.domain.tld autodiscover.domain.tld mail.domain.tld

So I was assuming that it was done right..
What information I can give you to troubleshoot it ?

ETNyx

Most common issue is that admins usually copy only “leaf” (cert.pem -> cert.pem) from proxy and you need to load fullchain cert into your server.

Browsers are usually fine whit leaf but mail clients strictly need fullchain cert (fullchain.pem -> cert.pem).

Your test does not cover this difference, fast check would be cat cert.pem (in MC) you should see something like

-----BEGIN CERTIFICATE-----   ← your leaf (mail.domain.tld)
MIID...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----   ← Let's Encrypt intermediate
MIIF...
-----END CERTIFICATE-----

also this should show chain openssl s_client -connect mail.domain.tld:993 -servername mail.domain.tld

CONNECTED(00000003)
depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X1
verify return:1
depth=2 C=US, O=ISRG, CN=Root YR
verify return:1
depth=1 C=US, O=Let's Encrypt, CN=YR2
verify return:1
depth=0 CN=REDACTED
verify return:1
---
Certificate chain
 0 REDACTED
 1 s:C=US, O=Let's Encrypt, CN=YR2
   i:C=US, O=ISRG, CN=Root YR
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Sep  3 00:00:00 2025 GMT; NotAfter: Sep  2 23:59:59 2028 GMT
 2 s:C=US, O=ISRG, CN=Root YR
   i:C=US, O=Internet Security Research Group, CN=ISRG Root X1
   a:PKEY: RSA, 4096 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: May 13 00:00:00 2026 GMT; NotAfter: Sep  2 23:59:59 2032 GMT
---

hokydok

Well… I think I resolved something… Don’t really know, newbie here…

The “cat cert.pem” gave me :
-----BEGIN CERTIFICATE----- MIID... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIC... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIC... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIE.... -----END CERTIFICATE-----
I don’t know if the letter after MII means something special..

The “openssl s_client…” gave me :
CONNECTED(00000003) depth=3 C = US, O = Internet Security Research Group, CN = ISRG Root X2 verify return:1 depth=2 C = US, O = ISRG, CN = Root YE verify return:1 depth=1 C = US, O = Let's Encrypt, CN = YE2 verify return:1 depth=0 CN = autoconfig.domain.tld verify return:1 -- Certificate chain 0 s:CN = autoconfig.domain.tld i:C = US, O = Let's Encrypt, CN = YE2 a: PKEY: id-ecPublicKey, 384 (bit); sigalg: ecdsa-with-SHA384 v:NotBefore: Jun 6 13:35:25 2026 GMT; NotAfter: Sep 4 13:35:24 2026 GMT 1 s:C = US, O = Let's Encrypt, CN = YE2 i:C = US, O = ISRG, CN = Root YE a: PKEY: id-ecPublicKey, 384 (bit); sigalg: ecdsa-with-SHA384 v:NotBefore: Sep 3 00:00:00 2025 GMT; NotAfter: Sep 2 23:59:59 2028 GMT 2 s:C = US, O = ISRG, CN = Root YE i:C = US, O = Internet Security Research Group, CN = ISRG Root X2 a: PKEY: id-ecPublicKey, 384 (bit); sigalg: ecdsa-with-SHA384 v:NotBefore: May 13 00:00:00 2026 GMT; NotAfter: Sep 2 23:59:59 2032 GMT 3 s:C = US, O = Internet Security Research Group, CN = ISRG Root X2 i:C = US, O = Internet Security Research Group, CN = ISRG Root X1 a: PKEY: id-ecPublicKey, 384 (bit); sigalg: RSA-SHA256 v:NotBefore: May 13 00:00:00 2026 GMT; NotAfter: Sep 2 23:59:59 2032 GMT

I followed this link : mailcow/mailcow-dockerized4867
I’ve activated ENABLE_SSL_SNI

And also made a mistake when I wanted to add the mailbox to my phone
It was automaticly pointed to “domain.tld” and not “mail.domain.tld”

Well it worked… I succeed to add the mailbox to my phone and also tested it with thunderbird…

Thanks that you took some time for me !