Automatically generate new certificates for new main domain

Questions
1

Your question

I recently just switched my main domain, meaning that the certificates for my previous one are no longer valid.
How do I get Stalwart to generate new certificates for my new domain and its subdomains?
ACME TLS certificate management is enabled for the domain, no additional hostnames have been set, and a valid ACME provider has been set.
When checking Settings > TLS > Certificates, there were only certificates generated for the previous domain (which I then removed).

Things I have tried

Disabling Caddy and binding to 443 directly
Restarting Stalwart
Running the reload TLS certificates action
Creating a new “Perform ACME certificate renewal for a domain” task

How can I get Stalwart to generate those certificates again?

Docker version 0.16.19
Logs show no meaningful information

2

Certificate issuance is tied entirely to the Domain object’s certificateManagement field, not to the previously‑removed domain’s leftover certificate. To get Stalwart to obtain a certificate for the new domain (and its subdomains) automatically, check the following:

  1. The Domain record must exist and be set to Automatic mode. Under Settings › Management › Domains, the new domain’s certificateManagement needs @type: "Automatic" with acmeProviderId pointing to a valid AcmeProvider, and subjectAlternativeNames listing any subdomains you want covered (leave empty for a wildcard/default set, otherwise list each hostname, e.g. autoconfig, mail, etc. — the domain suffix is appended automatically, so to include the bare apex you must enter it explicitly).

  2. The challenge type must actually be satisfiable from your network setup. If you’re using TlsAlpn01 (the default), the ACME validation happens over port 443 during the TLS handshake itself — this only succeeds if Stalwart is directly reachable on 443 for that domain at the moment the challenge runs, and DNS for the new domain/subdomains must already resolve to the server. If you’re going through Caddy normally, switching to Http01 or a Dns01/DnsPersist01 challenge (which needs a configured DNS provider for the zone) is often more reliable behind a proxy.

  3. Triggering the AcmeRenewal task only works if it targets the correct domainId. The task carries a domainId field referencing the Domain object — if that ID is stale or the task isn’t tied to the new domain’s record, nothing will happen. Recreate the task against the current Domain ID for the new domain, or better, just re-save the Domain’s certificateManagement field, which schedules the first renewal task automatically.

  4. Check ACME-specific log events, not just general error logs — look for acme.auth-start, acme.auth-pending, acme.auth-invalid, and acme.error events (raise the trace/log level for the acme module if you see nothing) to see whether a challenge is even being attempted and why it might be failing.

Details: TLS certificates | Stalwart and Configuration | Stalwart

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

The new domain record does exist and Certificate Management is set to ACME TLS certificate management with a valid ACME provider. Additional hostnames is left empty.
The challenge is satisfiable – the previous domain created certificates successfully with the same setup.

Checking the logs now, I see that when I schedule a certificate renewal task, I get a warning: No TLS certificates available: total = 0

4

Turns out the initial certificates are only generated on domain creation. I had to disable Caddy before adding the domain or it would have failed and never tried again.