I receive “TLS handshake error” and the mail client informs that the SSL certificate has expired. But this is handled by ACME and did not fail before. How to debug and force renewal of certificates on v0.15? (The migration process was started but not finalized)
Let me look at the tasks-actions doc for the exact WebUI/CLI steps to trigger the task, plus the task object fields.
This gives me enough to answer clearly.
Debugging: check Management → Tasks → Failed in the WebUI for an AcmeRenewal task on the affected domain; the task’s failureReason will show why renewal is failing (commonly a DNS/HTTP challenge failure). You can also enable and review the acme.* events in the log/trace viewer, particularly acme.auth-error, acme.order-invalid, acme.tls-alpn-error, and acme.error, which explain the specific cause (e.g. challenge validation failure, rate limiting via acme.renew-backoff).
To force renewal: create a new AcmeRenewal task for the domain. In the WebUI this is done from Management › Tasks with the New Task button (selecting the AcmeRenewal variant and the affected domain’s domainId); from the CLI you can run stalwart-cli create task/acmeRenewal with the domain id. Triggering this task on demand causes an immediate renewal attempt rather than waiting for the scheduled one.
Also verify the Domain’s certificateManagement is still set to automatic and points at the correct acmeProviderId, and that the AcmeProvider’s challenge type (Http01, Dns01, DnsPersist01, TlsAlpn01) still matches your infrastructure, since a network/DNS change is a common reason renewal silently starts failing.
For reference: TLS certificates and Tasks.
This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.
no webui access, only the cli v0.15 is available. Failure reason is “renew backoff”, but certificate is expired!
I’d like to request a human intervention to fix the migration and upgrade to v0.16, but no email available.
We do not offer a migration service yet, but we plan to announce one next year. If you contact [email protected] they will refer you to a partner company who can help you with that.
Problem is: I can’t send email 
Is there a way to chat with @helpbot in private? That would be useful to debug without exposing stuff nor polluting the forum. I have a mental block with the current migration documentation that prevents me from making it happen correctly: there is way too much stuff to read and branches to follow. I just need simple steps. I’m missing way too much practical information about how to configure old and new stalwart and how to transfer accounts in one shot. The process is way too complicated as it is for the amount of brain bandwidth available to me at the moment.
renew backoff is the retry notice, not the failure. The same event carries a CausedBy field, and that is the part that says why the order was rejected. It doubles nine times, about seventeen minutes, then gives up and retries hourly, so your log has a long trail of them by now. Post one complete event with CausedBy intact and I can tell you what is breaking.
That also explains why the server looks healthy from its own side: nothing in the certificate selection path checks expiry, so it keeps serving the expired certificate quite happily while every client refuses it.
If you need to send mail today, do not wait on ACME. Put a manually obtained certificate in certificate.<name>.cert and certificate.<name>.private-key, and sort out the renewal afterwards with the pressure off. When you do come back to it, purging the ACME cache forces a clean re-order: GET /api/store/purge/in-memory/<store>/acme drops both the cached certificate and the account key, then restart.
When a renewal that used to work stops, the challenge port has usually stopped being reachable from outside (80 for http-01, 443 for tls-alpn-01), or DNS changed for one of the names listed in acme.<id>.domains, or Let’s Encrypt has rate-limited you after the repeated failures. The CausedBy field will say which.
On the migration, the linear procedure you asked for exists now: stalw.art/docs/migration/guide, and it has an explicit path for an older Stalwart as the source. It is the proxy-and-vandelay route, and it reads as a sequence of steps with none of the branching in the upgrade notes you were working from.