1 Topic by kemechedzhiev

  • kemechedzhiev
  • Member
  • Offline
  • Registered: 2016-08-08
  • Posts: 2

Topic: Need help with SSL cert

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.5-1
- Linux/BSD distribution name and version: CentOS 7 x64
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): PGSQL
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? No
- Related log if you're reporting an issue:
====

Hello. I need some help with setup. After installing the iRedMail I try to get the SSL certificate with 'certbot certonly', but it's an error:
Failed authorization procedure. donapt.aaanet.ru (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Failed to connect to 217.74.242.18:443 for TLS-SNI-01 challenge.

It's a weird situation, because I can't control my domain name by myself, the only way to make a DNS setup is to write a letter to my provider. So, I ask them about:
A: (NAME: mail.donapt.aaanet.ru; TTL:1800; DATA: 195.151.12.206)
PTR: (195.151.12.206 PTR mail.donapt.aaanet.ru)
MX: (NAME: donapt.aaanet.ru.; PRIORITY: 10; DATA: mail.donapt.aaanet.ru)
SPF: (NAME: donapt.aaanet.ru.; 3600; IN TXT "v=spf1 mx mx:donapt.aaanet.ru -all")
DKIM: (dkim._domainkey.donapt.aaanet.ru DATA: v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKBiRwQd1IIoLzQikTidJx8weJDpjfDhTecwGBMAuMJ445S+trP4spXggHYCOF5iCpbtlOv6aKEuJ2J3TrzAUXj6K2pBYrQXNXm+RkCKkqB5HoFGIX83gLgtgYWgTz+n8INEHS6P8i2LWgqqY5amIGJnxo809+J1D6WMD9dojxEQIDAQAB")

My domain name is "donapt.aaanet.ru", FQDN - "mail.donapt.aaanet.ru". Maybe I was wrong in DNS queries? Can you give my an advise?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Need help with SSL cert

With 'certonly' option, LetsEncrypt server will try to access file under 'http://<your_domain>/.well-known/', so your Nginx must allow the access.

Note: file /etc/nginx/templates/misc.tmpl has rule to disable all access to file startswith a dot, you must place rule before it to allow access to '/.well-known'.

3 Reply by kemechedzhiev

  • kemechedzhiev
  • Member
  • Offline
  • Registered: 2016-08-08
  • Posts: 2

Re: Need help with SSL cert

ZhangHuangbin wrote:

With 'certonly' option, LetsEncrypt server will try to access file under 'http://<your_domain>/.well-known/', so your Nginx must allow the access.

Note: file /etc/nginx/templates/misc.tmpl has rule to disable all access to file startswith a dot, you must place rule before it to allow access to '/.well-known'.


Thank you very much.