Mailcow-dockerized: Force mailcow to renew SSL

[DJIronic]

Hello,

I did a big mistake. Somehow, I enabled cloudflare's proxy and CDN for my mail record of one domain.. (mail.domain.tld). It was there with CloudFlare's flexible SSL settings, so I did not now about it..until now...because the old SSL certs is out now and of course because of the CF proxy, this domain can't get re-validated.. So my question is. How can I add this subdomain into Lets encrypt and how to force mailcow to update the cert with this domain?

Thank you

[hachre]

Remove Cloudflare from that domain so that it resolves to the real IP again, then restart acme-mailcow and it should automatically check and renew as far as I know.

Restart and check the logs with:

docker-compose restart acme-mailcow && docker-compose logs -f --tail=100 acme-mailcow

If the sub domain isn't mentioned in any of your mail domains, you might have to add it by editing mailcow.conf and adding it to the ADDITIONAL_SAN variable.

[DJIronic]

OK, CloudFlare already removed.

acme-mailcow_1 | acme-client: /var/lib/acme/acme/cert.pem: expanding with domain: mail.domain.tld
and then
acme-mailcow_1 | Sun Jan 7 18:00:30 UTC 2018 - ACME certificate validation done. Sleeping for another day.

And yes, site works now. Thank you very much. 👍

[dokbua]

Remove Cloudflare from that domain so that it resolves to the real IP again, then restart acme-mailcow and it should automatically check and renew as far as I know.

Restart and check the logs with:

docker-compose restart acme-mailcow && docker-compose logs -f --tail=100 acme-mailcow

If the sub domain isn't mentioned in any of your mail domains, you might have to add it by editing mailcow.conf and adding it to the ADDITIONAL_SAN variable.

I needed to add another mail domain to my pod, so I added it to the ADDITIONAL_SAN variable and restarted docker-compose as explained here. The log output just showed that it couldn't find some autodiscover and autoconfig A records, so it ended saying nothing had changed.

What do I need to do to force it to check for this update?

[andryyy]

DNS is cached. DNS changes are never instant.

Try to restart unbound-mailcow to clear the cache.

[dokbua]

I don't quite understand the link to DNS - the domains I want to add already resovles in DNS - but anyway, I restarted unbound-mailcow, then restarted acme-mailcow . Unfortunately the log still shows no change..

[andryyy]

If it resolves for you, it may not resolve for me. Changes in DNS are not instant. We can have a different cache. This is _all_ about DNS. :)

But you may be missing what's described in the docs: docker-compose up -d to actually apply the changes to additional_san. :)