Certificate has a problem: The certificate has expired or is not yet valid.

[monarc83]

I noticed that expired TLS (SSL) certificates will not be renewed currently, maybe due to the Let's Encrypt changes!? How is this gonna be addressed and solved for MiaB? Is it possible to trigger the renewal manually as a workaround?

[downtownallday]

Have you examined /var/log/letsencrypt/letsencrypt.log for error messages?

[monarc83]

No error messages lately...

Both [mta-sts] certificates have expired and have not been renewed before.

[downtownallday]

You could try running management/ssl_certificates.py mta-sts.mydomain.tld from the command line

[monarc83]

did not work, but again no error messages... more ideas? Am I the only one with this issue?

[kiekerjan]

What is the output for these domains when you run management/ssl_certificates.py? You say no errors, but it should at least give a status for each required domain.

[monarc83]

oh, good hint, I missed that in the GUI maybe.

skipped: mta-sts.*****:
The domain name does not resolve to this machine: [Not Set] (AAAA).

skipped: mta-sts.*****:
The domain name does not resolve to this machine: [Not Set] (AAAA).

[monarc83]

Hmm, rDNS checks for IPv4 and IPv6 are fine. No idea what the issue is, hopefully someone else!?

[kiekerjan]

Are you letting the box serve dns? Or some external dns provider? In the latter case, check that the A/AAAA records for the mta-sts subdomain are set.
There's probably also a warning on this on the Admin Status page.

[monarc83]

All setup up correctly at Cloudflare, but following errors are visible.

2x MTA-STS policy is missing: STSFetchResult.FETCH_ERROR
-> This is due to the expired Certificate

This box's reverse DNS is currently [Not Set], but it should be mail.die-familie-nowak.de. Your ISP or cloud provider will have instructions on setting up reverse DNS for this box.
-> No Idea why the system is reporting this, external rDNS checks are valid and fine

[kiekerjan]

There seems to be no aaaa dns entry for the mta-sts subdomain, that will block requesting the certificate.
Reverse dns indeed seems fine. Perhaps the dns resolver is not functioning correctly. Can you check the output of sudo systemctl status named perhaps sudo systemctl restart named is needed?

[monarc83]

so, I do need to setup a AAAA entry for mta-sts subdomain at Cloudflare?

[kiekerjan]

Yes

[monarc83]

perfect, it worked. Thanks @kiekerjan

Not sure why there were certificates which expired at all. Haven't change any DNS settings at Cloudflare lately