Hi, Mailcow (Docker, compose v5.4.0, Ubuntu) can’t issue Let’s Encrypt certs. acme-mailcow keeps trying HTTP-01 (fails) even with DNS-01 enabled (ACME_DNS_CHALLENGE=y, Reg.ru). Logs show IP mismatch: container sees 89.250.2.157, but jilserv.ru DNS returns 31.31.196.121. Also seeing an ambiguous redirect error in obtain-certificate-dns.sh. IPv6 isn’t detected. Log snippet: text acme-mailcow-1 | Confirmed A record with IP 89.250.2.157, but HTTP validation failed acme-mailcow-1 | Cannot match your IP 89.250.2.157 against hostname jilserv.ru (DNS returned 31.31.196.121) acme-mailcow-1 | Cannot validate any hostnames, skipping Let's Encrypt for 1 hour. Env: two IPs on host; jilserv.ru → 31.31.196.121, mail2.jilserv.ru → 89.250.2.157. Tried recreating acme-mailcow, rolling back VM, manual acme.sh (falls back to HTTP). Questions: Why does it ignore DNS-01 and use HTTP-01 anyway? How to handle the ambiguous redirect issue? Best practice for domain/subdomain with different IPs? Want either a fix for auto-issuance or clear steps to use a manually issued cert and disable auto-issuance (SKIP_LETS_ENCRYPT=y). Thanks for any help!

Are you using a reverse proxy? What is MAILCOW_HOSTNAME in mailcow.conf? mail.jilserv.ru and mail2.jilserv.ru seem to be 2 different mailcow installation on 2 different IP addresses, and both have the default self signed mailcow certificate and the same MX record. Why?

Environment: Server 1: mail.jilserv.ru, MX 10 Server 2: mail2.jilserv.ru, MX 20 Each one has a separate installation of Mailcow in Docker Compose. Domain: jilserv.ru. The reverse proc is not used. What I tried: MAILCOW_HOSTNAME=jilserv.ru MAILCOW_HOSTNAME=mail.jilserv.ru MAILCOW_HOSTNAME=mail2.jilserv.ru DNS‑challenge (ACME_DNS_CHALLENGE=y, provider dns_regru) on both servers: invalid domain error, TXT record is not created. Reg.ru support did not respond. HTTP‑challenge: on both servers I set ACME_DNS_CHALLENGE=n, SKIP_HTTP_VERIFICATION=n, deleted data/conf/acme/dns-01.conf, completely recreated the stack (docker compose down && up -d). UFW: status: inactive. Port 80 is available.

If you are running it on the same host/VM, it cannot work. port 80 can only be bound by one mailcow installation. Why do you need 2 installations at all, if they serve the same mail domain? Mailcow is not meant to be clustered, there should only be one mailcow installation per host.

port 80 on that server is not listening to http, but to https. any other service running on mail.jilserv.ru that is binding to port 80? I am still waiting for the output of `netstat -tulpen` [upl-image-preview uuid=f8c43756-aa74-4274-a8e4-d5a113bc25f1 url=https://community.mailcow.email/assets/files/2026-08-17/1786951101-14736-grafik.png alt={TEXT?}]

Mailcow: Let’s Encrypt fails — HTTP validation + IP mismatch

Zimag05

Mailcow on different hosts, the backup server is used as a relay, both machines have different Internet access.
Here’s what happens if:
ACME_DNS_CHALLENGE=n
SKIP_HTTP_VERIFICATION=n
acme-mailcow-1 | OK
acme-mailcow-1 | Sun Aug 16 16:46:46 MSK 2026 - Initializing, please wait…
acme-mailcow-1 | Could not find certificate from <stdin>
acme-mailcow-1 | Could not find certificate from <stdin>
acme-mailcow-1 | Sun Aug 16 16:46:46 MSK 2026 - Using existing domain rsa key /var/lib/acme/acme/key.pem
acme-mailcow-1 | Sun Aug 16 16:46:46 MSK 2026 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem
acme-mailcow-1 | Sun Aug 16 16:46:46 MSK 2026 - Detecting IP addresses…
acme-mailcow-1 | Sun Aug 16 16:46:56 MSK 2026 - OK: 89.250.2.157, 0000:0000:0000:0000:0000:0000:0000:0000
acme-mailcow-1 | Sun Aug 16 16:46:56 MSK 2026 - Found A record for mail2.jilserv.ru: 89.250.2.157
acme-mailcow-1 | Sun Aug 16 16:49:06 MSK 2026 - Confirmed A record with IP 89.250.2.157, but HTTP validation failed
acme-mailcow-1 | Sun Aug 16 16:49:06 MSK 2026 - Cannot validate any hostnames, skipping Let’s Encrypt for 1 hour.
acme-mailcow-1 | Sun Aug 16 16:49:06 MSK 2026 - Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently.
acme-mailcow-1 | OK

esackbauer

Your port 80 is not answering/not open. Is there any other firewall in front like from your hosting provider?
Please post output of netstat -tulpen

Zimag05

Thanks, I figured it out. Helped ADDITIONAL_SAN ADDITIONAL_SERVER_NAMES

Zimag05

I was happy early. mail2.jilserv.ru worked, but on mail.jilserv.ru everything is the same, the settings are the same.
acme-mailcow-1 | Sun Aug 16 21:26:36 MSK 2026 - Initializing, please wait…
acme-mailcow-1 | Could not find certificate from <stdin>
acme-mailcow-1 | Could not find certificate from <stdin>
acme-mailcow-1 | Sun Aug 16 21:26:36 MSK 2026 - Using existing domain rsa key /var/lib/acme/acme/key.pem
acme-mailcow-1 | Sun Aug 16 21:26:36 MSK 2026 - Using existing Lets Encrypt account key /var/lib/acme/acme/account.pem
acme-mailcow-1 | Sun Aug 16 21:26:36 MSK 2026 - Detecting IP addresses…
acme-mailcow-1 | Sun Aug 16 21:26:46 MSK 2026 - OK: 176.99.138.126, 0000:0000:0000:0000:0000:0000:0000:0000
acme-mailcow-1 | Sun Aug 16 21:26:46 MSK 2026 - Found A record for imap.jilserv.ru: 176.99.138.126
acme-mailcow-1 | Sun Aug 16 21:28:55 MSK 2026 - Confirmed A record with IP 176.99.138.126, but HTTP validation failed
acme-mailcow-1 | Sun Aug 16 21:28:55 MSK 2026 - Found A record for smtp.jilserv.ru: 176.99.138.126
acme-mailcow-1 | Sun Aug 16 21:31:06 MSK 2026 - Confirmed A record with IP 176.99.138.126, but HTTP validation failed
acme-mailcow-1 | Sun Aug 16 21:31:06 MSK 2026 - Found A record for autodiscover.jilserv.ru: 176.99.138.126
acme-mailcow-1 | Sun Aug 16 21:33:17 MSK 2026 - Confirmed A record with IP 176.99.138.126, but HTTP validation failed
acme-mailcow-1 | Sun Aug 16 21:33:17 MSK 2026 - Found A record for autoconfig.jilserv.ru: 176.99.138.126
acme-mailcow-1 | Sun Aug 16 21:35:28 MSK 2026 - Confirmed A record with IP 176.99.138.126, but HTTP validation failed
acme-mailcow-1 | Sun Aug 16 21:35:28 MSK 2026 - MTA-STS is not enabled for jilserv.ru - skipping mta-sts subdomain certificate
acme-mailcow-1 | Sun Aug 16 21:35:28 MSK 2026 - Found A record for mail.jilserv.ru: 176.99.138.126
acme-mailcow-1 | Sun Aug 16 21:37:39 MSK 2026 - Confirmed A record with IP 176.99.138.126, but HTTP validation failed
acme-mailcow-1 | Sun Aug 16 21:37:39 MSK 2026 - Cannot validate any hostnames, skipping Let’s Encrypt for 1 hour.
acme-mailcow-1 | Sun Aug 16 21:37:39 MSK 2026 - Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently.
acme-mailcow-1 | OK

esackbauer

Zimag05 acme-mailcow-1 | Cannot match your IP 89.250.2.157 against hostname jilserv.ru (DNS returned 31.31.196.121)

Are you using a dynamic IP address? It seems you have always different IPs…

Zimag05

I don’t use dynamic addresses.
The main server is mail.jilserv.ru 176.99.138.126, the archive server is mail2.jilserv.ru 89.250.2.157.
Validation passed on the archive server. On the main server with the same settings, validation does not work.
There is also a business card server on which the site is raised and the domain name jilserv.ru 31.31.196.121 is registered. It has nothing to do with mail servers.

curl -I http://mail.jilserv.ru/.well-known/acme-challenge/dummy
HTTP/1.1 404 Not Found
Server: nginx
Date: Sun, 16 Aug 2026 23:54:35 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive

esackbauer

port 80 on that server is not listening to http, but to https.
any other service running on mail.jilserv.ru that is binding to port 80?
I am still waiting for the output of netstat -tulpen

Zimag05

esackbauer

Ok, port 80 is bound by a docker container. This should be the nginx container of mailcow. Check the nginx logs, if there are requests on port 80 served. If not you have a network problem, not a mailcow problem 😉
Now I am running out of ideas. Is there a transparent proxy in front of your server? Check with your hosting provider.
Are you or your hosting provider using a firewall in front with NAT rules?

Zimag05

nginx-mailcow-1 | 188.255.25.217 - - [17/Aug/2026:14:38:20 +0300] “HEAD /.well-known/acme-challenge/test-1786966700 HTTP/1.1” 404 0 “-” “curl/8.5.0” “-”
nginx-mailcow-1 | 2026/08/17 14:38:20 [error] 22#22: *14475 open() “/web/.well-known/acme-challenge/test-1786966700” failed (2: No such file or directory), client: 188.255.25.217, server: mail.jilserv.ru, request: “HEAD /.well-known/acme-challenge/test-1786966700 HTTP/1.1”, host: “mail.jilserv.ru”
Mailcow is behind NAT, as in the case of the backup server, the network settings are the same

esackbauer

Zimag05 2: No such file or directory

looks like your installation is broken. check file system rights for data/web/ it should have root as owner and 755 as rights.
remember never to use sudo with mailcow. always do things as root. also check for umask 0022, it should be set before installing mailcow.

Zimag05

esackbauer Thanks for support!!!

Zimag05

This helped
SKIP_IP_CHECK=y
SKIP_HTTP_VERIFICATION=y