Can Default Hostname be a sibling of Domain?

Questions
1

Your question

I may have misconfigured Stalwart with an unsupported setup and hope @helpbot with its excellent source-level understanding can help me out.

My setup

My Domain Name is set to m.filts.net and Default Hostname is set to madalena.filts.net, which matches the Reverse DNS records. IMHO, that should be a legal way to set up a mailserver.
I have a DNS Provider configured and am using that for ACME Dns01 and automatic DNS management.
I am using 0.16.18 from a checkout a couple of days ago.

The issue

The https certificate is only for madalena.filts.net, while it should also include mta-sts.m.filts.net, likely among others.

Looking at the source

The important function appears to be build_domains in network/acme/order.rs in the common crate. Judging from the result, hostnames appears to be non-empty for me, likely containing madalena.filts.net.
The only caller of that function is acme_renew in renew.rs, which sets the hostnames argument to subject_alternative_names and where those are set, I don’t understand.

Looking further at build_domains, even if I were to hit the Dns01 branch, I would be missing a certificate for Default Hostname, as that is where all the DNS records point to.

Questions

Should my setup be supported or should I change Reverse DNS and Default Hostname to m or m.filts.net? How would that result in an empty hostnames argument, so that a wildcard certificate gets ordered? That is where I don’t understand the source.

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

Your reading of the source is right, and the behaviour you’re seeing is expected given how build_domains works, not a bug in your config.

Why madalena.filts.net isn’t covered

When a Domain’s subjectAlternativeNames is left empty and the challenge type isn’t DNS-01, the server builds a default SAN set (see build_domains in crates/common/src/network/acme/order.rs):

  • It adds the technical hostnames mta-sts, ua-auto-config, autoconfig, autodiscover under the Domain’s own zone (m.filts.net).
  • It adds the server’s Default Hostname (server_name) only if it matches that same zone, i.e. equals m.filts.net or ends in .m.filts.net.
  • It adds any MX/service hostnames that likewise fall inside that zone.

Since your Default Hostname is madalena.filts.net, a sibling of m.filts.net rather than a subdomain of it, the zone check fails and it’s silently excluded from the default SAN set, even though it’s the actual name presented on the TLS connection. That matches the certificate you’re seeing (SANs limited to madalena.filts.net, the CN/leaf added elsewhere, but missing mta-sts.m.filts.net etc. because… actually in your case it’s the reverse: you’re missing the technical hostnames because those get requested for m.filts.net, while madalena.filts.net itself only ends up on the cert via some other path such as the AutoConfig default). Either way, the mismatch between the Domain’s Domain Name and Default Hostname’s zone is exactly why the SAN sets diverge.

For the DNS-01/wildcard branch (empty SANs + Dns01/DnsPersist01 challenge), the wildcard requested is *.m.filts.net plus m.filts.net itself, again scoped to the Domain’s own zone, so madalena.filts.net would still not be covered by that wildcard either, since it isn’t a subdomain of m.filts.net.

What to do

Per the docs on Automatic certificates, you don’t have to rely on the default SAN set: set subjectAlternativeNames on the Domain explicitly. Since it contains a dot, madalena.filts.net will be taken as a full hostname rather than appended to the domain:

{
  "subjectAlternativeNames": ["madalena.filts.net", "mta-sts", "autoconfig", "autodiscover"]
}

That will get you a single certificate that covers both your reverse-DNS hostname and the technical subdomains of m.filts.net. Alternatively, if you want the automatic defaults to “just work” without listing SANs, set Default Hostname to something under the m.filts.net zone (e.g. madalena.m.filts.net) and update your PTR record to match.

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

For the record, the complete list of technical domains, according to order.rs, is

["mta-sts", "ua-auto-config", "autoconfig", "autodiscover"]

On the Domain Object, under “Additional Hostnames”, which was the field I was looking for, I could also set *.m.filts.net to get a wildcard certificate.

Setting “madalena.filts.net” there, got me that name in Subject Alt Names in addition to Common Name. I might try to leave that out for the next renewal, but it won’t hurt for now.

I continue to be amazed by the quality of answers by that bot. That is a very nice aspect of user experience.