TLS certificate location

Questions
1

Your question

Stalwart has created through the API a CAA record for one of my domains, which I also use elsewhere. This makes it impossible for other servers, using this domain, to obtain a TLS certificate
As I understand, stalwart creates wildcard domain normally, so I might be able to use the wildcard certificate created by Stalwart , and copy it over to my other server / services.
Question: where do I find the TLS certificate files to copy over?

2

Now I have enough. Automatically-issued (ACME) certs are stored in Stalwart’s internal data store, not as files on disk — there’s no filesystem path to copy. To reuse the same cert elsewhere, you’d need to export it via the Certificate object in the WebUI/API rather than looking for a file.

Certificates issued or managed by Stalwart (including ones from ACME) are not written out as loose files on disk by default. They’re stored as Certificate objects in Stalwart’s own data store, and you retrieve them through the WebUI (or API/CLI), not from a filesystem path.

To copy the certificate:

  1. Open the WebUI and go to Settings › TLS › Certificates.
  2. Find the record whose Subject Alternative Names match your domain (the wildcard cert Stalwart obtained).
  3. The record’s certificate field holds the PEM-encoded certificate chain and privateKey holds the PEM-encoded private key, both of which you can copy out and install on your other server.

If you had instead configured the private key with a file reference (e.g. "privateKey": {"@type": "File", "filePath": "/opt/stalwart-smtp/etc/private/tls.key"}), it would live at that path on disk, but for ACME-issued certificates the account keys and certificate material are kept in the data store rather than on the filesystem.

Regarding the CAA record issue: since Stalwart manages CAA automatically for domains under its automatic certificate management, if you need other servers/services to obtain their own certificates for the same domain, you’ll want to either add their CA to the CAA record permissions or switch that domain’s certificateManagement mode so CAA isn’t restricted to Stalwart’s provider only.

Reference: TLS certificates | Stalwart and Certificates | Stalwart

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

Two follow-up questions:

  • is it correct, that by default a wildcard is created? I found the Certificate page, but it lists alternative names (autoconfig.whatev.net, autodiscover.whatev.net, mta-sts.whatev.net, ua-auto-config.whatev.net) … does this mean, there’s no wildcard?
  • in order to use the cert on the other machine, do I need the key file, or is it sufficient to copy what is under Certificate, as PEM format (consisting of three sections). I can export the PEM, but don’t see the key
4

There are no files to find. ACME account keys, certificates and renewal state all live in the data store rather than on the filesystem, and the private key is marked secret, so what the webui exports is the chain only. That rules out copying the pair to your other host.

You are also not getting a wildcard. The default challenge type is TLS-ALPN-01, and only the two DNS-based challenges can validate a wildcard domain. The alternative names you are seeing (autoconfig., autodiscover., mta-sts., ua-auto-config.) are the default SAN set, which is what that list is.

The thing actually blocking you is the CAA record, and that is worth fixing directly rather than routing around: it gets published because the domain has automatic DNS management with caa in publishRecords, which is on by default. Either drop caa from that set or widen the record to include the CA your other server uses, and it can then issue its own certificate. If you genuinely want one shared wildcard instead, switch the ACME provider to DNS-01 and leave the domain’s subjectAlternativeNames empty.