mthax
My use case with MC is on debian, but with cloudflare using dns challenge. I was hopeful there was some kind of built in mechanism to support dns challenge as I don’t and didn’t want to open up 80/443 to inbound to traffic.
I should add, ipv6 is entirely disabled in both the host and mailcow. Initial LE cert was obtained using the built in client by opening up ports 80/443 but this was not a long term solution. Ultimately found this,
https://gist.github.com/greenmoss/8ee9d4acd3a21df699cde2225a78399e
Which does the job with a few modifications, mainly copying the certs to data/assets/ssl (rather than sym linking) and data/assets/ssl/{domain name}. Mailcow docs say certs go to data/assets/ssl, but doing so only reflects on nginx, not postfix and dovecot, which appear to pull the cert from data/assets/ssl/{domain name}.
This makes sense, especially if mailcow is handling multiple domains. I am puzzled however why nginx isn’t using certs from {domain name}. If multiple domains are configured then the web ui should be accessible on them all, no?
You mentioned you’re using pfsense. That has a built in (optional) acme package supporting cloudflare/dns. I would just use that to obtain the cert then push it via scp or ssh. Run a periodic cron job on mailcow to compare nginx (or dovecot/postfix) fingerprint or serial to that of certs. If matches do nothing, if not (indicating cert files are newer), restart nginx, dovecot and postfix to install the new certs.