My relay has expired certificate and cmdeploy run fails

Chatmail Relays
1

Hi, I’m having big problems with deploy on sediz.iosa.it atm, the certificate is expired

There is a cmdeploy log here Disroot Bin - Encrypted pastebin by PrivateBin

all steps related to acme and certificates fail

2

IPv6 address 2a03:4000:55:fc4:: that is in your AAAA record does not answer and Let’s Encrypt tries to connect over IPv6. Don’t know what is with IPv6 on your server (IPv4 works). Just removing AAAA record should help, or you can try to fix IPv6 connectivity.

3

Confirming the above, I ran my monitor script against this relay and while there are IPv6 DNS records, none of the ports are reachable. Snippets of the output:

* Host sediz.iosa.it:25 was resolved.
* IPv6: 2a03:4000:55:fc4::
* IPv4: 202.61.252.44
*   Trying [2a03:4000:55:fc4::]:25...
*   Trying 202.61.252.44:25...
* Connected to sediz.iosa.it (202.61.252.44) port 25

* Host sediz.iosa.it:465 was resolved.
* IPv6: 2a03:4000:55:fc4::
* IPv4: 202.61.252.44
*   Trying [2a03:4000:55:fc4::]:465...
*   Trying 202.61.252.44:465...
* TLSv1.3 (OUT), TLS handshake, Client hello (1):

* Host sediz.iosa.it:143 was resolved.
* IPv6: 2a03:4000:55:fc4::
* IPv4: 202.61.252.44
*   Trying [2a03:4000:55:fc4::]:143...
*   Trying 202.61.252.44:143...
* Connected to sediz.iosa.it (202.61.252.44) port 143

* Host sediz.iosa.it:993 was resolved.
* IPv6: 2a03:4000:55:fc4::
* IPv4: 202.61.252.44
*   Trying [2a03:4000:55:fc4::]:993...
*   Trying 202.61.252.44:993...
* TLSv1.3 (OUT), TLS handshake, Client hello (1):

* Host sediz.iosa.it:80 was resolved.
* IPv6: 2a03:4000:55:fc4::
* IPv4: 202.61.252.44
*   Trying [2a03:4000:55:fc4::]:80...
*   Trying 202.61.252.44:80...
* Connected to sediz.iosa.it (202.61.252.44) port 80

* Host sediz.iosa.it:443 was resolved.
* IPv6: 2a03:4000:55:fc4::
* IPv4: 202.61.252.44
*   Trying [2a03:4000:55:fc4::]:443...
*   Trying 202.61.252.44:443...
* ALPN: curl offers h2,http/1.1

Removing the AAAA would be the quick fix, sorting out IPv6 connectivity would be the long term desirable fix.

Edit: to help you diagnose, I can share that the IPv6 connections are an instant fail (REJECT of packets) and not a DROP (blackhole the packets). Curl downgraded from v6 to v4 instantly, there wasn’t a lag waiting on it to timeout typical with a packet drop/hang.