{"action":"created","issue":{"url":"https://api.github.com/repos/mailcow/mailcow-dockerized/issues/2509","repository_url":"https://api.github.com/repos/mailcow/mailcow-dockerized","labels_url":"https://api.github.com/repos/mailcow/mailcow-dockerized/issues/2509/labels{/name}","comments_url":"https://api.github.com/repos/mailcow/mailcow-dockerized/issues/2509/comments","events_url":"https://api.github.com/repos/mailcow/mailcow-dockerized/issues/2509/events","html_url":"https://github.com/mailcow/mailcow-dockerized/pull/2509","id":430415751,"node_id":"MDExOlB1bGxSZXF1ZXN0MjY4MzA4MTEw","number":2509,"title":"Different SSL Certificate for each Domain with TLS SNI","user":{"login":"mhofer117","id":3976393,"node_id":"MDQ6VXNlcjM5NzYzOTM=","avatar_url":"https://avatars3.githubusercontent.com/u/3976393?v=4","gravatar_id":"","url":"https://api.github.com/users/mhofer117","html_url":"https://github.com/mhofer117","followers_url":"https://api.github.com/users/mhofer117/followers","following_url":"https://api.github.com/users/mhofer117/following{/other_user}","gists_url":"https://api.github.com/users/mhofer117/gists{/gist_id}","starred_url":"https://api.github.com/users/mhofer117/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mhofer117/subscriptions","organizations_url":"https://api.github.com/users/mhofer117/orgs","repos_url":"https://api.github.com/users/mhofer117/repos","events_url":"https://api.github.com/users/mhofer117/events{/privacy}","received_events_url":"https://api.github.com/users/mhofer117/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2019-04-08T12:12:36Z","updated_at":"2019-04-10T20:31:02Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/mailcow/mailcow-dockerized/pulls/2509","html_url":"https://github.com/mailcow/mailcow-dockerized/pull/2509","diff_url":"https://github.com/mailcow/mailcow-dockerized/pull/2509.diff","patch_url":"https://github.com/mailcow/mailcow-dockerized/pull/2509.patch"},"body":"This addresses https://github.com/mailcow/mailcow-dockerized/issues/461 and most of the related issues:\r\n\r\n- Rebuilt acme container with certbot instead of acme-tiny:\r\n  - Generate a main server certificate with with the hostname and all fqdn additional sans\r\n  - Generate an additional certificate with autodiscover.* and any other san configured in this format (subdomain.*) for each domain\r\n  - All certificates are stored in a new volume `certbot-vol-1` but copied to the existing location for usage.\r\n- Changed nginx to serve individual vhosts with each certificate (SNI)\r\n- Changed dovecot to proxy submission (port 465) and smtps (port 587) and serve all certificates with SNI. This was required because postfix does not support SNI.\r\n- When upgrading, the existing certificate will be used until the certbot container was able to issue new certificates.\r\n- Certificates are no longer backed up to the `data/assets/ssl/backup` directory, as certbot keeps an archive of certificates in the `certbot-vol-1` folder. Can also be re-added if required.\r\n\r\nThe new certbot container is mostly a drop-in replacement for the current acme container and reuses a lot of the shell script functionality, including the existing config parameters and default certificate location.\r\n\r\n#### Main benefit:\r\n- allows unlimited domains because we are no longer limited to a single certificate with max. 100 subject alternative names. This should eliminate the need for most reverse proxy setups.\r\n\r\nIn theory, this also allows the usage of certbot validation plugins (like DNS validation), however the CERTBOT_PLUGIN_PARAMS variable is not yet configurable and most plugins are not installed in the container by default. This could be easily extended if required, but maybe this PR also solves the need for that?\r\n\r\n#### Drawbacks\r\n- Not all clients support SNI, see: https://wiki.dovecot.org/SSL/SNIClientSupport, however the server hostname or any other configured SAN in the default server certificate should still be valid with these clients.\r\n- On upgrade, the postfix container must first be stopped as ports 465 and 587 will be remapped to the dovecot container, but the [update.sh](https://github.com/mailcow/mailcow-dockerized/blob/master/update.sh#L297) script will do this anyway.\r\n\r\nIn my test setup with a few domains, everything is working as expected, but further testing is probably a good idea.\r\n\r\nShould we also extend the backup/resotre script to include the new volume? It's probably not that important as the certificates will just be re-issued in an emergency restore.\r\n\r\nIf you see any other problems with this PR or have major concerns let me know and i'll try to solve them."},"comment":{"url":"https://api.github.com/repos/mailcow/mailcow-dockerized/issues/comments/481850257","html_url":"https://github.com/mailcow/mailcow-dockerized/pull/2509#issuecomment-481850257","issue_url":"https://api.github.com/repos/mailcow/mailcow-dockerized/issues/2509","id":481850257,"node_id":"MDEyOklzc3VlQ29tbWVudDQ4MTg1MDI1Nw==","user":{"login":"mhofer117","id":3976393,"node_id":"MDQ6VXNlcjM5NzYzOTM=","avatar_url":"https://avatars3.githubusercontent.com/u/3976393?v=4","gravatar_id":"","url":"https://api.github.com/users/mhofer117","html_url":"https://github.com/mhofer117","followers_url":"https://api.github.com/users/mhofer117/followers","following_url":"https://api.github.com/users/mhofer117/following{/other_user}","gists_url":"https://api.github.com/users/mhofer117/gists{/gist_id}","starred_url":"https://api.github.com/users/mhofer117/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mhofer117/subscriptions","organizations_url":"https://api.github.com/users/mhofer117/orgs","repos_url":"https://api.github.com/users/mhofer117/repos","events_url":"https://api.github.com/users/mhofer117/events{/privacy}","received_events_url":"https://api.github.com/users/mhofer117/received_events","type":"User","site_admin":false},"created_at":"2019-04-10T20:31:02Z","updated_at":"2019-04-10T20:31:02Z","author_association":"CONTRIBUTOR","body":"I have now figured out the correct XCLIENT config and all sender restrictions are working because dovecot is telling postfix the real client IP and sender login with XCLIENT, see the following log:\r\n\r\n```\r\n---- SUCCESSFUL MAIL ----\r\nApr 10 22:25:01 mail2 postfix/postscreen[340]: CONNECT from [172.22.1.250]:50142 to [172.22.1.9]:25\r\nApr 10 22:25:01 mail2 postfix/postscreen[340]: WHITELISTED [172.22.1.250]:50142\r\nApr 10 22:25:01 mail2 postfix/smtpd[342]: connect from mailcowdockerized_dovecot-mailcow_1.mailcowdockerized_mailcow-network[172.22.1.250]\r\nApr 10 22:25:01 mail2 postfix/smtpd[342]: 97530166AAB: client=mailcowdockerized_dovecot-mailcow_1.mailcowdockerized_mailcow-network[84.x.x.x], sasl_method=XCLIENT, sasl_username=mhofer117@domain.local\r\nApr 10 22:25:01 mail2 postfix/cleanup[346]: 97530166AAB: message-id=<082f49bf-f372-3319-b2f4-1b1d7cf9c520@domain.local>\r\nApr 10 22:25:01 mail2 postfix/qmgr[337]: 97530166AAB: from=<mhofer117@domain.local>, size=1680, nrcpt=1 (queue active)\r\nApr 10 22:25:01 mail2 postfix/smtpd[342]: disconnect from mailcowdockerized_dovecot-mailcow_1.mailcowdockerized_mailcow-network[84.x.x.x] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5\r\nApr 10 22:25:02 mail2 postfix/lmtp[348]: 97530166AAB: to=<mhofer117@domain.local>, relay=dovecot[fd4d:6169:6c63:6f77::10]:24, delay=0.59, delays=0.39/0.03/0.05/0.13, dsn=2.0.0, status=sent (250 2.0.0 <mhofer117@domain.local> tAprAx5RrlyZAAAABx98KA Saved)\r\nApr 10 22:25:02 mail2 postfix/qmgr[337]: 97530166AAB: removed\r\n\r\n---- RATE LIMITED ----\r\nApr 10 22:24:54 mail2 postfix/postscreen[340]: CONNECT from [172.22.1.250]:50100 to [172.22.1.9]:25\r\nApr 10 22:24:54 mail2 postfix/postscreen[340]: WHITELISTED [172.22.1.250]:50100\r\nApr 10 22:24:54 mail2 postfix/smtpd[342]: connect from mailcowdockerized_dovecot-mailcow_1.mailcowdockerized_mailcow-network[172.22.1.250]\r\nApr 10 22:24:54 mail2 postfix/smtpd[342]: NOQUEUE: reject: RCPT from mailcowdockerized_dovecot-mailcow_1.mailcowdockerized_mailcow-network[84.x.x.x]: 550 5.1.0 <mhofer1171@domain.local>: Sender address rejected: User unknown in virtual mailbox table; from=<mhofer1171@domain.local> to=<mhofer117@domain.local> proto=ESMTP helo=<mail2.techcloud.dev>\r\nApr 10 22:24:56 mail2 postfix/smtpd[342]: disconnect from mailcowdockerized_dovecot-mailcow_1.mailcowdockerized_mailcow-network[84.x.x.x] ehlo=1 mail=1 rcpt=0/1 quit=1 commands=3/4\r\n\r\n---- SENDER RESTRICTIONS ----\r\nApr 10 22:25:08 mail2 postfix/postscreen[340]: CONNECT from [172.22.1.250]:50200 to [172.22.1.9]:25\r\nApr 10 22:25:08 mail2 postfix/postscreen[340]: WHITELISTED [172.22.1.250]:50200\r\nApr 10 22:25:08 mail2 postfix/smtpd[342]: connect from mailcowdockerized_dovecot-mailcow_1.mailcowdockerized_mailcow-network[172.22.1.250]\r\nApr 10 22:25:09 mail2 postfix/smtpd[342]: 017B1166AAB: client=mailcowdockerized_dovecot-mailcow_1.mailcowdockerized_mailcow-network[84.x.x.x], sasl_method=XCLIENT, sasl_username=mhofer117@domain.local\r\nApr 10 22:25:09 mail2 postfix/cleanup[346]: 017B1166AAB: message-id=<112afa8a-57d0-1357-25dd-ff0ab587a64c@domain.local>\r\nApr 10 22:25:09 mail2 postfix/cleanup[346]: 017B1166AAB: milter-reject: END-OF-MESSAGE from mailcowdockerized_dovecot-mailcow_1.mailcowdockerized_mailcow-network[84.x.x.x]: 4.7.1 Ratelimit \"mailcow\" exceeded; from=<mhofer117@domain.local> to=<mhofer117@domain.local> proto=ESMTP helo=<mail2.techcloud.dev>\r\nApr 10 22:25:10 mail2 postfix/smtpd[342]: disconnect from mailcowdockerized_dovecot-mailcow_1.mailcowdockerized_mailcow-network[84.x.x.x] ehlo=1 mail=1 rcpt=1 data=0/1 quit=1 commands=4/5\r\n```\r\n\r\nPlease let me know if you have further questions or concerns - or how I can improve this PR."}}
{"actor":{"display_login":"mhofer117"}}