How to properly add additional ACME cert hostnames?

[DSpeichert]

How to properly add additional ACME cert hostnames?

Here's what I tried and what happened:

1. Edited the ACME "directory" to add more hostnames
2. Saved & reloaded. Server shows log message (trace) that certificates for all names are loaded.
3. CT Logs show now certificate was requested and the default certificate is served for the newly added domain name.

Here's a workaround:

1. Added new ACME "directory " (also for Let's Encrypt) with the second domain only.
2. Reloaded once -> certificate was requested
3. Reloaded again -> certificate started being used

Here's what seems to be happening:

1. The directory's certificate names don't matter until next renewal and 1 directory == 1 certificate.
2. Log is incorrectly including the domain in "loading certificate for domains" message due to configuration, not because there actually was a certificate obtained.

Here's why I think this may not be a good solution:
Adding multiple "directories" probably creates multiple "accounts" with Let's Encrypt and there's a limit of 5 registrations per IP per 24h, which can be easily exceeded this way.

Here's what I think should happen:
Upon adding new hostnames, server should request new hostnames separately (so as not to "renew" all certificates because there's a SAN limit as well).

[mdecimus]

This depends on the limits imposed by your ACME provider. You can configure Stalwart to request certificates using a single account or multiple accounts. If you are reaching Let's Encrypt limit perhaps you should try obtaining a wildcard certificate for your domain rather than multiple certificates.

[mdecimus]

How can I request multiple certificates separately using a single ACME account?

Since the limits are also imposed on the account this wouldn't help I think. What you should do is either use wildcard certificates or create a separate ACME provider for each group of certificates you want to request.

[DSpeichert]

I don't believe there are limits to how many certificates an account can have. There is a limit on creating accounts per IP and creating certificates per domain (5 per week I believe). I'll try to find the reference from LE but I've been using a single account for lots of domains. It's not always appropriate to re-request a certificate for all domains when adding a new domain because it is prone to re-verification of all other domains and also shows all domains in the certificate.

Either way, how can I use a single provide in Stalwart Mail and add a new domain name before expiration of existing certificate?

See: https://letsencrypt.org/docs/rate-limits/

[mdecimus]

Either way, how can I use a single provide in Stalwart Mail and add a new domain name before expiration of existing certificate?

If you add a new domain name to an existing certificate, a new certificate including the previous plus the new domain name will be requested. If you want to avoid this you need to define a new ACME provider for the new domain name.

[DSpeichert]

Is there a way to troubleshoot if that isn't actually happening?

[mdecimus]

Yes, setting the log level to trace will help you troubleshoot