Problem with Tracking Domain

[mascor]

Hi, I created a Tracking Domain for my postal server following this procedure:
https://docs.postalserver.io/features/click-and-open-tracking.
I created "click.mydomain.com" as CNAME record that points to "track.postal.mydomain.com", an A record pointing to the Postal server.
Postal UI shows “CNAME configured correctly” in green but it shows “SSL enabled“ in grey. 
If I try to curl -I click.mydomain.com it answers with HTTP/2 525.
curl -I https://track.postal.mydomain.com -> curl: (35) LibreSSL/3.3.6: error:1404B438:SSL routines:ST_CONNECT:tlsv1 alert internal error
So the problem seems this certificate.
Will postal create the certificates for the new domain click.mydomain.com automatically?
"mydomain.com" is behind Cloudflare but all the postal records are setup as "DNS Only"

[willpower232]

I expect the grey SSL Enabled is not relevant any more, are you definitely on the latest Postal version?

You should be handling the certificate yourself in caddy (or nginx or whatever is managing the web hosts in your environment).

[mascor]

Actually, I'm using Postal 3.3.2.

If I'm not wrong when I set up the system he created the certificates for postal.mydomain.com by itself.
Why he did not create the certificates for track.postal.mydmain.com?
I never used caddy to set up a certificate and considering that the deployment is made through docker it should be able to setup by itself reading the /opt/postal/config/postal.yml file.

I found this post: #1350
where you wrote:
"Click tracking requires a separate IP address as it handles its own SSL certificates programmatically. This means your server will need at least two IP addresses. You could run click tracking on a separate server or customise your ports so that you can run the web UI on a different port but these are advanced and unsupported configurations."

I setup it on an external nginx server, using proxy_ssl_verify off:

server {
server_name click.

location / {
    proxy_pass https://track.postal.<hidden>;
    proxy_set_header X-Postal-Track-Host 1;
    proxy_ssl_verify off; # Disable SSL certificate verification
}

listen 443 ssl; # managed by Certbot
ssl_certificate <hidden>
ssl_certificate_key <hidden>
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

certificates on this server click. are working but It shows:
HTTP/1.1 502 Bad Gateway
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 25 Mar 2024 16:57:27 GMT
Content-Type: text/html
Content-Length: 166
Connection: keep-alive

so the problem is https://track.postal.. I also tried with proxy_pass http://track.postal.;
so there is a misconfiguration of track.postal. on the postal server.

The DNS section of postal.yml file is:
dns:

Specify the DNS records that you have configured. Refer to the documentation at

https://github.com/atech/postal/wiki/Domains-&-DNS-Configuration for further

information about these.

mx_records:
- mx.postal.
smtp_server_hostname: postal.
spf_include: spf.postal.
return_path: rp.postal.
route_domain: routes.postal.
track_domain: track.postal.

and all these records are point to the IP server of postal.

[willpower232]

Postal has changed quite dramatically since that comment. You have added a host to your nginx for the root tracking domain which is supposed to act as a CNAME and not be used directly.

track.postal.com CNAME postal.com

track.clientdomain.com CNAME track.postal.com

and then you need an SSL certificate for track.clientdomain.com (also making use of proxy_set_header X-Postal-Track-Host 1;)

I would also say that the nginx config for your tracking domain should be almost identical to the nginx config for your main Postal UI, i.e. they should both have the same proxy_pass.

[mascor]

I was able to with this /opt/postal/config/Caddyfile file:

postal.mydomain.com {
reverse_proxy 127.0.0.1:5000
}

track.mydomain.com {
reverse_proxy 127.0.0.1:5000 {
header_up X-Postal-Track-Host "1"
}
}

click.mydomain.com {
reverse_proxy 127.0.0.1:5000 {
header_up X-Postal-Track-Host "1"
}
}

Thanks

[charlesmudy]

@willpower232 Hi ... is there a way to have one universal track domain? Currently you must create a tracking domain to each domain if you want the link to be tracked.

I would like to have 1 default tracker appended for all domain? Possible?