Unable to obtain tls certificate

Issues
1

Issue Description

I’ve installed stalwart mail server on Rocky linux 9 and I had problem with tls certificate. The ACME provider is defined and domain configured to use my acme, however stalwart won’t obtain certificate. I can switch to manual and use letsencrypt, however I prefer to automate this.
Stalwart version 0.16.16. I got another stalwart server but with quit old version, there everything works fine.
Stalwart server is using hostname like mail.myserver, however mail accounts should be created for myserver.com domain. I’m not sure which domain will be considering in my case so I’ve created ACME for a both domains. Also I’ve changed url for acme to testing , to prevent stalwart reach out the limit on production. Do you know how I can investigate this? Do I need install stalwart-cli to enforce creating tls certificate?

Expected Behavior

Certificate tls should be obtained automatically

Actual Behavior

No TLS certificates available

Reproduction Steps

  1. Install stalwart with script
  2. set up ACME
  3. Set up domain and make sure the acme is selected
  4. Set up listeners and make sure port 443 is configured and not blocked by firewall
  5. restart stalwart

Relevant Log Output

No TLS certificates available
Invalid request: ACME not configured for domain

Stalwart Version

v0.16.x

Installation Method

Binary (Linux)

Database Backend

RocksDB

Blob Storage

RocksDB

Search Engine

Internal

Directory Backend

Internal

Additional Context

Server has public IP, no NAT. Firewall has defined all necessary rules, such us allowed http, https and so on.

I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.

on

I have searched this support forum (open and closed topics) and confirm this is not a duplicate.

on

I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.

on

2

Those two messages say different things, and the second one has a hint. “ACME not configured for domain” comes from exactly one place, and it only fires when the Domain object still has Certificate Management set to Manual. The renewal task is keyed to the domain rather than to the ACME provider, so defining the provider isn’t enough on its own: open the domain, set certificate management to Automatic, and select the provider there. “No TLS certificates available” is just downstream of that; it means the store is empty and the self-signed fallback is in use.

The hostname is the other half. mail.myserver has no public TLD, so no CA can validate it, and it would never end up in a certificate for myserver.com either, since only names inside that zone get included. What you want is a single Domain object for myserver.com with the server hostname set to mail.myserver.com, rather than a domain per hostname.

One thing to check after that: the directory URL can’t be edited once a provider exists, so if you created a second provider pointing at staging, the domain has to point at whichever one you actually intend, and staging certificates won’t be trusted by clients anyway. You don’t need the CLI to force issuance; saving the domain with automatic management triggers a renewal task.