Mailcow-dockerized: ACME bad response

[Triscuit47]

Hello,
I managed to install mailcow on a fresh Ubuntu 16.04. Everything is fine except the fact that acme can't acquire a certificate. And the web ui https connection is, of course, not trusted. Now, I have a NAS on my network as well which is my DNS server and Web Server for some Web Pages and for them to work properly I have to use mailcow's web ui on port 8080 and 8443. I know there is a requirement to have the port 80 opened for acme to work but is there any way around this?

acme-mailcow_1 | Wed Jan 10 12:38:20 UTC 2018 - Waiting for domain tables... OK
acme-mailcow_1 | Wed Jan 10 12:38:20 UTC 2018 - Found A record for autoconfig.mydomain.tld: 11.22.33.44
acme-mailcow_1 | Wed Jan 10 12:38:20 UTC 2018 - Confirmed A record autoconfig.mydomain.tld
acme-mailcow_1 | Wed Jan 10 12:38:20 UTC 2018 - Found A record for autodiscover.mydomain.tld: 11.22.33.44
acme-mailcow_1 | Wed Jan 10 12:38:20 UTC 2018 - Confirmed A record autodiscover.mydomain.tld
acme-mailcow_1 | Wed Jan 10 12:38:20 UTC 2018 - Found A record for mail.mydomain.tld: 11.22.33.44
acme-mailcow_1 | Wed Jan 10 12:38:20 UTC 2018 - Confirmed A record mail.mydomain.tld
acme-mailcow_1 | acme-client: /var/lib/acme/acme/private/account.key: account key exists (not creating)
acme-mailcow_1 | acme-client: /var/lib/acme/acme/private/privkey.pem: domain key exists (not creating)
acme-mailcow_1 | acme-client: adding SAN: autoconfig.mydomain.tld
acme-mailcow_1 | acme-client: adding SAN: autodiscover.mydomain.tld
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/directory: directories
acme-mailcow_1 | acme-client: acme-v01.api.letsencrypt.org: DNS: 184.85.247.152
acme-mailcow_1 | acme-client: acme-v01.api.letsencrypt.org: DNS: 2a02:26f0:c00:4b0::3d5
acme-mailcow_1 | acme-client: acme-v01.api.letsencrypt.org: DNS: 2a02:26f0:c00:4a7::3d5
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/new-authz: req-auth: mail.mydomain.tld
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/new-authz: req-auth: autoconfig.mydomain.tld
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/new-authz: req-auth: autodiscover.mydomain.tld
acme-mailcow_1 | acme-client: /var/www/acme/uKqwC6ih6iZSrposHHiVNRmLuLLnER87qzQoqyAtTmo: created
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/challenge/n7I8G2yTjT5NfmF5HMFFK2MgkWyj3gdlozdYbagC_jw/3046259314: challenge
acme-mailcow_1 | acme-client: /var/www/acme/rOhATXQ-d2xavFQKBusAGe_HiMPp448C4g50vVjOMjQ: created
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/challenge/kEQMAt3XMcaIGI2zayXJKCKdlH1VSPgIYOWiWmht7Vs/3046259428: challenge
acme-mailcow_1 | acme-client: /var/www/acme/M3FXFOVRo04AFdUARXWx7U2r2hnUvfGW_BXC0az9hAM: created
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/challenge/0yoiGth52of_FimGHFHNYC0vtHxi796h7NEl0F0R_HQ/3046259481: challenge
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/challenge/n7I8G2yTjT5NfmF5HMFFK2MgkWyj3gdlozdYbagC_jw/3046259314: status
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/challenge/n7I8G2yTjT5NfmF5HMFFK2MgkWyj3gdlozdYbagC_jw/3046259314: bad response
acme-mailcow_1 | acme-client: transfer buffer: [{ "type": "http-01", "status": "invalid", "error": { "type": "urn:acme:error:unauthorized", "detail": "Invalid response from http://mail.mydomain.tld/.well-known/acme-challenge/uKqwC6ih6iZSrposHHiVNRmLuLLnER87qzQoqyAtTmo: \"\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n\u003cmeta charset=\"utf-8\"\u003e\n\u003cstyle\u003ebody{font-family:Arial,Helvetica,sans-serif;font-size:12px;text-alig\"", "status": 403 }, "uri": "https://acme-v01.api.letsencrypt.org/acme/challenge/n7I8G2yTjT5NfmF5HMFFK2MgkWyj3gdlozdYbagC_jw/3046259314", "token": "uKqwC6ih6iZSrposHHiVNRmLuLLnER87qzQoqyAtTmo", "keyAuthorization": "uKqwC6ih6iZSrposHHiVNRmLuLLnER87qzQoqyAtTmo.FcieX-Kx-UVWcVR6ta_HHXSgD3pfoCKU_H82miVs6MA", "validationRecord": [ { "url": "http://mail.mydomain.tld/.well-known/acme-challenge/uKqwC6ih6iZSrposHHiVNRmLuLLnER87qzQoqyAtTmo", "hostname": "mail.mydomain.tld", "port": "80", "addressesResolved": [ "11.22.33.44" ], "addressUsed": "11.22.33.44", "addressesTried": [] } ] }] (1088 bytes)
acme-mailcow_1 | acme-client: bad exit: netproc(1411): 1

[hachre]

Is mail.mydomain.tld resolvable and reachable from the outside? Did you allow enough time for DNS settings to propagate?

Does the following near the bottom of your log show the correct IP address for mail.mydomain.tld?

"hostname": "mail.mydomain.tld", "port": "80", "addressesResolved": [ "11.22.33.44" ], "addressUsed": "11.22.33.44", "

[Triscuit47]

Yes, I am currently using the mail server properly. I can send and receive emails, everything works as it should. The only problem being the certificate.

[hachre]

Did you change anything regarding the reachablility of Mailcow's own Nginx on ports 80 and 443 or change the Nginx configuration in some way?

[Triscuit47]

As I stated, I did change Mailcow's ports from 80 to 8080 and 443 to 8443 for the 2nd web-server I use to work properly.

[hachre]

Oh sorry, I missed that. Alright, I guess that's the problem then. Will have to wait for a Dev's response here!

[Triscuit47]

Not a problem. Yeah I concluded that myself too...I only hope there's a workaround.

[hachre]

I think the only option is to set up the frontend webserver, which is handling your port 80 (as seen from the internet), to route any requests for "/.well-known/" to the Mailcow web server internally. This can be achieved via a ProxyPass directive on Apache for example.

[Triscuit47]

Haven't thought about that. I will give it a go and see what I can achieve. I will report back when I get around it. Thank you.

[wtrdk]

Maybe it has something to do with this: https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996

[Triscuit47]

Hello again.
After following @hachre 's advice, acme log looks like this:

acme-mailcow_1 | Fri Jan 12 11:46:52 UTC 2018 - Waiting for domain tables... OK
acme-mailcow_1 | Fri Jan 12 11:46:52 UTC 2018 - Found A record for autoconfig.mydomain.tld: 11.22.33.44
acme-mailcow_1 | Fri Jan 12 11:46:52 UTC 2018 - Confirmed A record autoconfig.mydomain.tld
acme-mailcow_1 | Fri Jan 12 11:46:52 UTC 2018 - Found A record for autodiscover.mydomain.tld: 11.22.33.44
acme-mailcow_1 | Fri Jan 12 11:46:52 UTC 2018 - Confirmed A record autodiscover.mydomain.tld
acme-mailcow_1 | Fri Jan 12 11:46:52 UTC 2018 - Found A record for mail.mydomain.tld: 11.22.33.44
acme-mailcow_1 | Fri Jan 12 11:46:52 UTC 2018 - Confirmed A record mail.mydomain.tld
acme-mailcow_1 | acme-client: /var/lib/acme/acme/private/account.key: account key exists (not creating)
acme-mailcow_1 | acme-client: /var/lib/acme/acme/private/privkey.pem: domain key exists (not creating)
acme-mailcow_1 | acme-client: adding SAN: autoconfig.mydomain.tld
acme-mailcow_1 | acme-client: adding SAN: autodiscover.mydomain.tld
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/directory: directories
acme-mailcow_1 | acme-client: acme-v01.api.letsencrypt.org: DNS: 184.85.247.152
acme-mailcow_1 | acme-client: acme-v01.api.letsencrypt.org: DNS: 2a02:26f0:c00:4b0::3d5
acme-mailcow_1 | acme-client: acme-v01.api.letsencrypt.org: DNS: 2a02:26f0:c00:4a7::3d5
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/new-authz: req-auth: mail.mydomain.tld
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/new-authz: req-auth: autoconfig.mydomain.tld
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/new-authz: req-auth: autodiscover.mydomain.tld
acme-mailcow_1 | acme-client: /var/www/acme/vpRTVi1ka2Qd7ryjn3xtvdq5Wl0pphhYqioxPzwUNaQ: created
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/challenge/FyVBcjNmNvxhCsk4vUJZPLUkdfCKYy-KSlf3Q_yH_L8/3065388729: challenge
acme-mailcow_1 | acme-client: /var/www/acme/E03XSknTW_h766zh2LuEy_ONd7XrJn_KDpd_hOHJrGY: created
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/challenge/F4IYULWOmgF_QM2fXqEEw2v3UM9HyiocP5223dRfcVE/3065388831: challenge
acme-mailcow_1 | acme-client: /var/www/acme/HoYFYE_QxxG23VI4JFmVWTUMMFm51bN-z4YAZ1NM7yk: created
acme-mailcow_1 | acme-client: https://acme-v01.api.letsencrypt.org/acme/challenge/NfE9vubG_gUWutYpVZ0EmLzmGcrbJc-3AfJQl7rakNk/3065388930: challenge

However the certificate wasn't applied. These are the changes I made to sites.conf:

location /.well.known/acme-challenge/ {
proxy_pass http://11.22.33.44:8080/;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_redirect on;
}

[hachre]

I think some of the log is cut off. It should give out more info about whether it will expand the cert and so on below the stuff you posted.

[Triscuit47]

Yeah it did, I checked after I posted and returned the same error, forgot to report back. The changes I made to nginx are relevant in any way?

[hachre]

So it still says this essentially?

bad response
acme-mailcow_1 | acme-client: transfer buffer: [{ "type": "http-01", "status": "invalid", "error": { "type": "urn:acme:error:unauthorized", "detail": "Invalid response from http://mail.mydomain.tld/.well-known/acme-challenge

Did you make those changes to the Nginx that's included in Mailcow? You need to make those changes to whatever webserver handles your port 80 as seen from the Internet.

[Triscuit47]

Oh right, I am dumb. I will do the settings there then. Thanks a lot :D