TLS Setup [SSL_TYPE=manual] File /docker/certificates/example.com.key or /docker/certificates/example.com.crt does not exist!

[borisservo]

Hello,

I'm trying to configure the certificates in dockermail as manual but I'm facing an situation that it says that files do not exist.

$ docker compose up
[+] Running 0/1
 ⠦ Container mailserver  Created                                                               0.6s 
Attaching to mailserver
mailserver  | [   INF   ]  Welcome to docker-mailserver v13.3.1
mailserver  | [   INF   ]  Checking configuration
mailserver  | [   INF   ]  Configuring mail server
mailserver  | [ WARNING ]  You need at least one mail account to start Dovecot (120s left for account creation before shutdown)
mailserver  | [  ERROR  ]  TLS Setup [SSL_TYPE=manual] | File /docker/certificates/example.com.key or /docker/certificates/example.com.crt does not exist!
mailserver  | [  ERROR  ]  Shutting down
mailserver  | 2024-04-27 23:52:30,035 WARN received SIGTERM indicating exit request
mailserver exited with code 0

compose.yaml below

services:
  mailserver:
    image: ghcr.io/docker-mailserver/docker-mailserver:latest
    container_name: mailserver
    # Provide the FQDN of your mail server here (Your DNS MX record should point to this value)
    hostname: mail.example.com
    # Automatic cleanup (removes older image pulls from wasting disk space):
    environment:
      - SSL_TYPE=manual
      - ENABLE_RSPAMD=1
      - ENABLE_CLAMAV=1
      - ENABLE_FAIL2BAN=1
      - ONE_DIR=1
      - POSTFIX_MESSAGE_SIZE_LIMIT=26214400
      - ENABLE_OPENDKIM=0
      - ENABLE_OPENDMARC=0
      - ENABLE_POLICYD_SPF=0
      - ENABLE_AMAVIS=0
      - ENABLE_SPAMASSASSIN=0
      - SSL_CERT_PATH=/docker/certificates/example.com.crt
      - SSL_KEY_PATH=/docker/certificates/example.com.key
    env_file: mailserver.env

    # More information about the mail-server ports:
    # https://docker-mailserver.github.io/docker-mailserver/latest/config/security/understanding-the-ports/
    # To avoid conflicts with yaml base-60 float, DO NOT remove the quotation marks.
    ports:
      - "465:465"  # ESMTP (implicit TLS)
      - "587:587"  # ESMTP (explicit TLS => STARTTLS)
      - "993:993"  # IMAP4 (implicit TLS)
    volumes:
      - ./docker-data/dms/custom-certs/:/docker/certificates/:ro
      - ./docker-data/dms/mail-data/:/docker/dockermail/mail/data
      - ./docker-data/dms/mail-state/:/docker/dockermail/mail/state/
      - ./docker-data/dms/mail-logs/:/var/log/mail/
      - ./docker-data/dms/config/:/docker/dockermail/mail/tmp/
      - /etc/localtime:/etc/localtime:ro

    restart: unless-stopped
    stop_grace_period: 1m
    cap_add:
     - NET_ADMIN
    healthcheck:
      test: "ss --listening --tcp | grep -P 'LISTEN.+:smtp' || exit 1"
      timeout: 3s
      retries: 0

Certificates folder.

$  ls -la /docker/certificates/
total 32
drwxrwxrwx   2 zumo docker 4096 Apr 27 22:59 .
drwxrwxr-x+ 10 root   docker 4096 Apr 27 22:59 ..
-rwxrwxrwx   1 zumo docker 5254 Apr 27 21:53 example.com.all.pem
-rwxrwxrwx   1 zumo docker 1826 Apr 27 21:53 example.com.ca
-rwxrwxrwx   1 zumo docker 1753 Apr 27 21:53 example.com.crt
-rwxrwxrwx   1 zumo docker 3579 Apr 27 21:53 example.com.fullchain
-rwxrwxrwx   1 zumo docker 1675 Apr 27 21:53 example.com.key

How come is saying that it doesn't if the files are the location configured in the yaml.
Am I missing something in terms of configuration?

[glime-ai[bot]]

Please note that this response was created using generative AI, leveraging previously available information from the repository. This information may be helpful. However, it is our strong recommendation that you carefully consider the information before blindly applying it.

---

It appears that the issue you're encountering is related to the volume mapping in your compose.yaml file. The error message indicates that the Docker container cannot find the specified certificate files at the paths /docker/certificates/example.com.crt and /docker/certificates/example.com.key. This suggests a potential mismatch between the paths specified in the environment variables and the actual paths inside the container due to how the volumes are mounted.

Here are a few steps to troubleshoot and resolve this issue:

1. Correct Volume Mapping: Ensure that the volume mapping in your compose.yaml correctly maps the host directory containing the certificates to the expected directory inside the container. Based on your configuration, you have:

   volumes:
     - ./docker-data/dms/custom-certs/:/docker/certificates/:ro

   This should correctly map the ./docker-data/dms/custom-certs/ directory on your host to /docker/certificates/ inside the container. Make sure that the host directory path is correct and contains the certificate files.

2. File Permissions: Check the permissions of the certificate files on your host machine. The Docker container might not be able to read the files if the permissions are too restrictive. You can set the permissions with:

   chmod 644 /path/to/your/certificates/*.crt
   chmod 644 /path/to/your/certificates/*.key

3. Container Filesystem: You can manually check if the files are correctly mounted inside the container by accessing the container's shell and listing the contents of /docker/certificates/:

   docker exec -it mailserver /bin/bash
   ls -la /docker/certificates/

   This will show you what files are visible inside the container at the mounted path.

4. Environment Variables: Double-check the environment variables SSL_CERT_PATH and SSL_KEY_PATH to ensure they match the paths inside the container where the certificates are supposed to be located.

5. Docker Compose Up: After making any changes, remember to restart your Docker container to apply the changes:

   docker compose down
   docker compose up -d

If after these steps the issue persists, it might be helpful to check the Docker logs for any additional error messages that could provide more insight into what might be going wrong.

This comment was generated by Glime.

[borisservo]

Mixed up the directory from inside the container with the host corrected that all good.