Repository: Mailu/Mailu

Issue:
Letsencrypt Force Renewal
Is there a limit on the Subject Alt Name entries?

I have updated my /mailu/mailu.env "HOSTNAMES" variable, but when I restart Mailu it doesn't update the Subject Alt Names on the mailu cert.

Previously it has worked, so I am guessing that I need to force Letsencrypt to refresh as it isnt within the renewal window. But there is no guidance for the new letsencrypt certbot.

I am using the latest Mailu version (1.7) and this is the command I am using to restart mailu '/mailu/docker-compose -p mailu up -d'
Letsencrypt Force Renewal
Is there a limit on the Subject Alt Name entries?

I have updated my /mailu/mailu.env "HOSTNAMES" variable, but when I restart Mailu it doesn't update the Subject Alt Names on the mailu cert.

Previously it has worked, so I am guessing that I need to force Letsencrypt to refresh as it isnt within the renewal window. But there is no guidance for the new letsencrypt certbot.

I am using the latest Mailu version (1.7) and this is the command I am using to restart mailu '/mailu/docker-compose -p mailu up -d'


Discussion:
you can force renewal by attaching to the mailu_front container and running the following python script with some modifications. It is extracted from this repository.
https://github.com/Mailu/Mailu/blob/master/core/nginx/letsencrypt.py

What I did to solve the same problem, was to replace the `--keep-until-expiry` with `--force-renewal`, and then i removed the part on the bottom that will try to renew every hour, because we don't need that for running this once.

You can attach to the docker container by:
1. first finding the container id with `docker ps`
2. execute: `docker exec -it [container id here] /bin/bash`
3. Inside the container, run `python3`. This will launch the python shell.
4. Paste the entire code you modified inside, and let it finish.
5. When done, the script should finish. Press `CTRL+D` to exit the python shell.
6. type `exit` to exit the container.

Done!

This will force a renewal of the certificate using letsencrypt. 


Hi There,

The `Mailu`-Project is currently in a bit of a bind! We are short on man-power, and we need to judge if it is possible for us to put in some work on this issue.

To help with that, we are currently trying to find out which issues are actively keeping users from using `Mailu`, which issues have someone who want to work on them — and which issues may be less important. These a less important ones could be discarded for the time being, until the project is in a more stable and regular state once again.

In order for us to better assess this, it would be helpful if you could put a **reaction on this post** (use the :smiley: icon to the top-right).
- 👍️ if you **need this** to be able to use Mailu. Ideally, you’d also be able to test this on your installation, and provide feedback …
- 🎉 if you find it a **nice bonus**, but no deal-breaker
- 🚀 if you want to **work on it yourself**!
We want to keep this **voting open for 2 weeks** from now, so please help out!
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

thanks to @dennorske i got it renewed:
```
$ docker ps  | grep mailu_front
$ docker exec -it [container id here] /bin/bash 
bash-5.0# certbot -n --agree-tos -d $HOSTNAMES -m $POSTMASTER@$DOMAIN certonly --standalone --cert-name mailu --preferred-challenges http --http-01-port 8008 --force-renewal --rsa-key-size 4096 --config-dir /certs/letsencrypt --post-hook /config.py
$ CTRL-D
# if you use a proxy own nginx
$ sudo service nginx restart
```

-> this sould probably also go to the FAQ or docs
According to https://certbot.eff.org/docs/using.html#changing-a-certificate-s-domains it should just work. 

https://github.com/Mailu/Mailu/blob/08a39aac4939e409d72d9b350b771d46e2b5dcae/core/nginx/letsencrypt.py#L11 is what is done under the hood... maybe the version of certbot shipped in 1.7 is buggy/too old?
I unfortunately did not check what the underlying reason was for the failed renewals - but it turned out forcing it did the trick. 
I haven't had issues since. 
@delijati  Im getting trying your solution, Im pretty sure Im missing something, but not sure of what, I did double check in the A/AAA and all is correct 

![Screen Shot 2021-08-06 at 11 40 04](https://user-images.githubusercontent.com/6392815/128543808-1c9e31c5-3e51-4875-ae13-908d60cf62b0.png)

> @delijati Im getting trying your solution, Im pretty sure Im missing something, but not sure of what, I did double check in the A/AAA and all is correct
> 
> ![Screen Shot 2021-08-06 at 11 40 04](https://user-images.githubusercontent.com/6392815/128543808-1c9e31c5-3e51-4875-ae13-908d60cf62b0.png)

This unfortunately seems unrelated to this issue, as it is in fact trying to renew.
It also states connection refused leading me to believe it could be a misconfiguration or firewall issue. 
Oh I see, just ! question in python code, why the config "http --http-01-port 8008" have a port 8008 why 8008 ? it should be 8008?

Because that's the port that's reverse-proxied by front/NGINX
see
https://github.com/Mailu/Mailu/blob/08a39aac4939e409d72d9b350b771d46e2b5dcae/core/nginx/conf/nginx.conf#L82
you can force renewal by attaching to the mailu_front container and running the following python script with some modifications. It is extracted from this repository.
https://github.com/Mailu/Mailu/blob/master/core/nginx/letsencrypt.py

What I did to solve the same problem, was to replace the `--keep-until-expiry` with `--force-renewal`, and then i removed the part on the bottom that will try to renew every hour, because we don't need that for running this once.

You can attach to the docker container by:
1. first finding the container id with `docker ps`
2. execute: `docker exec -it [container id here] /bin/bash`
3. Inside the container, run `python3`. This will launch the python shell.
4. Paste the entire code you modified inside, and let it finish.
5. When done, the script should finish. Press `CTRL+D` to exit the python shell.
6. type `exit` to exit the container.

Done!

This will force a renewal of the certificate using letsencrypt. 


Hi There,

The `Mailu`-Project is currently in a bit of a bind! We are short on man-power, and we need to judge if it is possible for us to put in some work on this issue.

To help with that, we are currently trying to find out which issues are actively keeping users from using `Mailu`, which issues have someone who want to work on them — and which issues may be less important. These a less important ones could be discarded for the time being, until the project is in a more stable and regular state once again.

In order for us to better assess this, it would be helpful if you could put a **reaction on this post** (use the :smiley: icon to the top-right).
- 👍️ if you **need this** to be able to use Mailu. Ideally, you’d also be able to test this on your installation, and provide feedback …
- 🎉 if you find it a **nice bonus**, but no deal-breaker
- 🚀 if you want to **work on it yourself**!
We want to keep this **voting open for 2 weeks** from now, so please help out!
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

thanks to @dennorske i got it renewed:
```
$ docker ps  | grep mailu_front
$ docker exec -it [container id here] /bin/bash 
bash-5.0# certbot -n --agree-tos -d $HOSTNAMES -m $POSTMASTER@$DOMAIN certonly --standalone --cert-name mailu --preferred-challenges http --http-01-port 8008 --force-renewal --rsa-key-size 4096 --config-dir /certs/letsencrypt --post-hook /config.py
$ CTRL-D
# if you use a proxy own nginx
$ sudo service nginx restart
```

-> this sould probably also go to the FAQ or docs
According to https://certbot.eff.org/docs/using.html#changing-a-certificate-s-domains it should just work. 

https://github.com/Mailu/Mailu/blob/08a39aac4939e409d72d9b350b771d46e2b5dcae/core/nginx/letsencrypt.py#L11 is what is done under the hood... maybe the version of certbot shipped in 1.7 is buggy/too old?
I unfortunately did not check what the underlying reason was for the failed renewals - but it turned out forcing it did the trick. 
I haven't had issues since. 
@delijati  Im getting trying your solution, Im pretty sure Im missing something, but not sure of what, I did double check in the A/AAA and all is correct 

![Screen Shot 2021-08-06 at 11 40 04](https://user-images.githubusercontent.com/6392815/128543808-1c9e31c5-3e51-4875-ae13-908d60cf62b0.png)

> @delijati Im getting trying your solution, Im pretty sure Im missing something, but not sure of what, I did double check in the A/AAA and all is correct
> 
> ![Screen Shot 2021-08-06 at 11 40 04](https://user-images.githubusercontent.com/6392815/128543808-1c9e31c5-3e51-4875-ae13-908d60cf62b0.png)

This unfortunately seems unrelated to this issue, as it is in fact trying to renew.
It also states connection refused leading me to believe it could be a misconfiguration or firewall issue. 
Oh I see, just ! question in python code, why the config "http --http-01-port 8008" have a port 8008 why 8008 ? it should be 8008?

Because that's the port that's reverse-proxied by front/NGINX
see
https://github.com/Mailu/Mailu/blob/08a39aac4939e409d72d9b350b771d46e2b5dcae/core/nginx/conf/nginx.conf#L82

Resolving patch:
diff --git a/core/nginx/letsencrypt.py b/core/nginx/letsencrypt.py
--- a/core/nginx/letsencrypt.py
+++ b/core/nginx/letsencrypt.py
@@ -13,6 +13,7 @@
     "--cert-name", "mailu",
     "--preferred-challenges", "http", "--http-01-port", "8008",
     "--keep-until-expiring",
+    "--renew-with-new-domains",
     "--config-dir", "/certs/letsencrypt",
     "--post-hook", "/config.py"
 ]
@@ -26,6 +27,7 @@
     "--preferred-challenges", "http", "--http-01-port", "8008",
     "--keep-until-expiring",
     "--key-type", "ecdsa",
+    "--renew-with-new-domains",
     "--config-dir", "/certs/letsencrypt",
     "--post-hook", "/config.py"
 ]


Test patch: