diff --git a/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/Dockerfile b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/Dockerfile
new file mode 100644
index 0000000..8369ce3
--- /dev/null
+++ b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/Dockerfile
@@ -0,0 +1,28 @@
+FROM alpine:3.11
+
+LABEL maintainer "Andre Peters <andre.peters@servercow.de>"
+
+RUN apk upgrade --no-cache \
+  && apk add --update --no-cache \
+  bash \
+  curl \
+  openssl \
+  bind-tools \
+  jq \
+  mariadb-client \
+  redis \
+  tini \
+  tzdata \
+  python3 \
+  && python3 -m pip install --upgrade pip \
+  && python3 -m pip install acme-tiny
+
+COPY acme.sh /srv/acme.sh
+COPY functions.sh /srv/functions.sh
+COPY obtain-certificate.sh /srv/obtain-certificate.sh
+COPY reload-configurations.sh /srv/reload-configurations.sh
+COPY expand6.sh /srv/expand6.sh
+
+RUN chmod +x /srv/*.sh
+
+CMD ["/sbin/tini", "-g", "--", "/srv/acme.sh"]
diff --git a/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/acme.sh b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/acme.sh
new file mode 100755
index 0000000..5d5da1e
--- /dev/null
+++ b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/acme.sh
@@ -0,0 +1,422 @@
+#!/bin/bash
+set -o pipefail
+exec 5>&1
+
+# Do not attempt to write to slave
+if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
+  export REDIS_CMDLINE="redis-cli -h ${REDIS_SLAVEOF_IP} -p ${REDIS_SLAVEOF_PORT}"
+else
+  export REDIS_CMDLINE="redis-cli -h redis -p 6379"
+fi
+
+until [[ $(${REDIS_CMDLINE} PING) == "PONG" ]]; do
+  echo "Waiting for Redis..."
+  sleep 2
+done
+
+source /srv/functions.sh
+# Thanks to https://github.com/cvmiller -> https://github.com/cvmiller/expand6
+source /srv/expand6.sh
+
+# Skipping IP check when we like to live dangerously
+if [[ "${SKIP_IP_CHECK}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+  SKIP_IP_CHECK=y
+fi
+
+# Skipping HTTP check when we like to live dangerously
+if [[ "${SKIP_HTTP_VERIFICATION}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+  SKIP_HTTP_VERIFICATION=y
+fi
+
+# Request certificate for MAILCOW_HOSTNAME only
+if [[ "${ONLY_MAILCOW_HOSTNAME}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+  ONLY_MAILCOW_HOSTNAME=y
+fi
+
+# Request individual certificate for every domain
+if [[ "${ENABLE_SSL_SNI}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+  ENABLE_SSL_SNI=y
+fi
+
+if [[ "${SKIP_LETS_ENCRYPT}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+  log_f "SKIP_LETS_ENCRYPT=y, skipping Let's Encrypt..."
+  sleep 365d
+  exec $(readlink -f "$0")
+fi
+
+log_f "Waiting for Docker API..."
+until ping dockerapi -c1 > /dev/null; do
+  sleep 1
+done
+log_f "Docker API OK"
+
+log_f "Waiting for Postfix..."
+until ping postfix -c1 > /dev/null; do
+  sleep 1
+done
+log_f "Postfix OK"
+
+log_f "Waiting for Dovecot..."
+until ping dovecot -c1 > /dev/null; do
+  sleep 1
+done
+log_f "Dovecot OK"
+
+ACME_BASE=/var/lib/acme
+SSL_EXAMPLE=/var/lib/ssl-example
+
+mkdir -p ${ACME_BASE}/acme
+
+# Migrate
+[[ -f ${ACME_BASE}/acme/private/privkey.pem ]] && mv ${ACME_BASE}/acme/private/privkey.pem ${ACME_BASE}/acme/key.pem
+[[ -f ${ACME_BASE}/acme/private/account.key ]] && mv ${ACME_BASE}/acme/private/account.key ${ACME_BASE}/acme/account.pem
+if [[ -f ${ACME_BASE}/acme/key.pem && -f ${ACME_BASE}/acme/cert.pem ]]; then
+  if verify_hash_match ${ACME_BASE}/acme/cert.pem ${ACME_BASE}/acme/key.pem; then
+    log_f "Migrating to SNI folder structure..."
+    CERT_DOMAIN=($(openssl x509 -noout -text -in ${ACME_BASE}/acme/cert.pem | grep "Subject:" | sed -e 's/\(Subject:\)\|\(CN = \)\|\(CN=\)//g' | sed -e 's/^[[:space:]]*//'))
+    CERT_DOMAINS=(${CERT_DOMAIN} $(openssl x509 -noout -text -in ${ACME_BASE}/acme/cert.pem | grep "DNS:" | sed -e 's/\(DNS:\)\|,//g' | sed "s/${CERT_DOMAIN}//" | sed -e 's/^[[:space:]]*//'))
+    mkdir -p ${ACME_BASE}/${CERT_DOMAIN}
+    mv ${ACME_BASE}/acme/cert.pem ${ACME_BASE}/${CERT_DOMAIN}/cert.pem
+    # key is only copied, not moved, because it is used by all other requests too
+    cp ${ACME_BASE}/acme/key.pem ${ACME_BASE}/${CERT_DOMAIN}/key.pem
+    chmod 600 ${ACME_BASE}/${CERT_DOMAIN}/key.pem
+    echo -n ${CERT_DOMAINS[*]} > ${ACME_BASE}/${CERT_DOMAIN}/domains
+    mv ${ACME_BASE}/acme/acme.csr ${ACME_BASE}/${CERT_DOMAIN}/acme.csr
+    log_f "OK" no_date
+  fi
+fi
+
+[[ ! -f ${ACME_BASE}/dhparams.pem ]] && cp ${SSL_EXAMPLE}/dhparams.pem ${ACME_BASE}/dhparams.pem
+
+if [[ -f ${ACME_BASE}/cert.pem ]] && [[ -f ${ACME_BASE}/key.pem ]] && [[ $(stat -c%s ${ACME_BASE}/cert.pem) != 0 ]]; then
+  ISSUER=$(openssl x509 -in ${ACME_BASE}/cert.pem -noout -issuer)
+  if [[ ${ISSUER} != *"Let's Encrypt"* && ${ISSUER} != *"mailcow"* && ${ISSUER} != *"Fake LE Intermediate"* ]]; then
+    log_f "Found certificate with issuer other than mailcow snake-oil CA and Let's Encrypt, skipping ACME client..."
+    sleep 3650d
+    exec $(readlink -f "$0")
+  fi
+else
+  if [[ -f ${ACME_BASE}/${MAILCOW_HOSTNAME}/cert.pem ]] && [[ -f ${ACME_BASE}/${MAILCOW_HOSTNAME}/key.pem ]] && verify_hash_match ${ACME_BASE}/${MAILCOW_HOSTNAME}/cert.pem ${ACME_BASE}/${MAILCOW_HOSTNAME}/key.pem; then
+    log_f "Restoring previous acme certificate and restarting script..."
+    cp ${ACME_BASE}/${MAILCOW_HOSTNAME}/cert.pem ${ACME_BASE}/cert.pem
+    cp ${ACME_BASE}/${MAILCOW_HOSTNAME}/key.pem ${ACME_BASE}/key.pem
+    # Restarting with env var set to trigger a restart,
+    exec env TRIGGER_RESTART=1 $(readlink -f "$0")
+  else
+    log_f "Restoring mailcow snake-oil certificates and restarting script..."
+    cp ${SSL_EXAMPLE}/cert.pem ${ACME_BASE}/cert.pem
+    cp ${SSL_EXAMPLE}/key.pem ${ACME_BASE}/key.pem
+    exec env TRIGGER_RESTART=1 $(readlink -f "$0")
+  fi
+fi
+
+chmod 600 ${ACME_BASE}/key.pem
+
+log_f "Waiting for database..."
+while ! mysqladmin status --socket=/var/run/mysqld/mysqld.sock -u${DBUSER} -p${DBPASS} --silent > /dev/null; do
+  sleep 2
+done
+log_f "Database OK"
+
+log_f "Waiting for Nginx..."
+until $(curl --output /dev/null --silent --head --fail http://nginx:8081); do
+  sleep 2
+done
+log_f "Nginx OK"
+
+log_f "Waiting for resolver..."
+until dig letsencrypt.org +time=3 +tries=1 @unbound > /dev/null; do
+  sleep 2
+done
+log_f "Resolver OK"
+
+# Waiting for domain table
+log_f "Waiting for domain table..."
+while [[ -z ${DOMAIN_TABLE} ]]; do
+  curl --silent http://nginx/ >/dev/null 2>&1
+  DOMAIN_TABLE=$(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SHOW TABLES LIKE 'domain'" -Bs)
+  [[ -z ${DOMAIN_TABLE} ]] && sleep 10
+done
+log_f "OK" no_date
+
+log_f "Initializing, please wait..."
+
+while true; do
+  POSTFIX_CERT_SERIAL="$(echo | openssl s_client -connect postfix:25 -starttls smtp 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
+  DOVECOT_CERT_SERIAL="$(echo | openssl s_client -connect dovecot:143 -starttls imap 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
+  POSTFIX_CERT_SERIAL_NEW="$(echo | openssl s_client -connect postfix:25 -starttls smtp 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
+  DOVECOT_CERT_SERIAL_NEW="$(echo | openssl s_client -connect dovecot:143 -starttls imap 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
+  # Re-using previous acme-mailcow account and domain keys
+  if [[ ! -f ${ACME_BASE}/acme/key.pem ]]; then
+    log_f "Generating missing domain private rsa key..."
+    openssl genrsa 4096 > ${ACME_BASE}/acme/key.pem
+  else
+    log_f "Using existing domain rsa key ${ACME_BASE}/acme/key.pem"
+  fi
+  if [[ ! -f ${ACME_BASE}/acme/account.pem ]]; then
+    log_f "Generating missing Lets Encrypt account key..."
+    openssl genrsa 4096 > ${ACME_BASE}/acme/account.pem
+  else
+    log_f "Using existing Lets Encrypt account key ${ACME_BASE}/acme/account.pem"
+  fi
+
+  chmod 600 ${ACME_BASE}/acme/key.pem
+  chmod 600 ${ACME_BASE}/acme/account.pem
+
+  unset EXISTING_CERTS
+  declare -a EXISTING_CERTS
+  for cert_dir in ${ACME_BASE}/*/ ; do
+    if [[ ! -f ${cert_dir}domains ]] || [[ ! -f ${cert_dir}cert.pem ]] || [[ ! -f ${cert_dir}key.pem ]]; then
+      continue
+    fi
+    EXISTING_CERTS+=("$(basename ${cert_dir})")
+  done
+
+  # Cleaning up and init validation arrays
+  unset SQL_DOMAIN_ARR
+  unset VALIDATED_CONFIG_DOMAINS
+  unset ADDITIONAL_VALIDATED_SAN
+  unset ADDITIONAL_WC_ARR
+  unset ADDITIONAL_SAN_ARR
+  unset CERT_ERRORS
+  unset CERT_CHANGED
+  unset CERT_AMOUNT_CHANGED
+  unset VALIDATED_CERTIFICATES
+  CERT_ERRORS=0
+  CERT_CHANGED=0
+  CERT_AMOUNT_CHANGED=0
+  declare -a SQL_DOMAIN_ARR
+  declare -a VALIDATED_CONFIG_DOMAINS
+  declare -a ADDITIONAL_VALIDATED_SAN
+  declare -a ADDITIONAL_WC_ARR
+  declare -a ADDITIONAL_SAN_ARR
+  declare -a VALIDATED_CERTIFICATES
+  IFS=',' read -r -a TMP_ARR <<< "${ADDITIONAL_SAN}"
+  for i in "${TMP_ARR[@]}" ; do
+    if [[ "$i" =~ \.\*$ ]]; then
+      ADDITIONAL_WC_ARR+=(${i::-2})
+    else
+      ADDITIONAL_SAN_ARR+=($i)
+    fi
+  done
+  ADDITIONAL_WC_ARR+=('autodiscover' 'autoconfig')
+
+  # Start IP detection
+  log_f "Detecting IP addresses..."
+  IPV4=$(get_ipv4)
+  IPV6=$(get_ipv6)
+  log_f "OK: ${IPV4}, ${IPV6:-"0000:0000:0000:0000:0000:0000:0000:0000"}"
+
+  # Hard-fail on CAA errors for MAILCOW_HOSTNAME
+  MH_PARENT_DOMAIN=$(echo ${MAILCOW_HOSTNAME} | cut -d. -f2-)
+  MH_CAAS=( $(dig CAA ${MH_PARENT_DOMAIN} +short | sed -n 's/\d issue "\(.*\)"/\1/p') )
+  if [[ ! -z ${MH_CAAS} ]]; then
+    if [[ ${MH_CAAS[@]} =~ "letsencrypt.org" ]]; then
+      log_f "Validated CAA for parent domain ${MH_PARENT_DOMAIN}"
+    else
+      log_f "Skipping ACME validation: Lets Encrypt disallowed for ${MAILCOW_HOSTNAME} by CAA record, retrying in 1h..."
+      sleep 1h
+      exec $(readlink -f "$0")
+    fi
+  fi
+
+  #########################################
+  # IP and webroot challenge verification #
+  SQL_DOMAINS=$(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain FROM domain WHERE backupmx=0" -Bs)
+  if [[ ! $? -eq 0 ]]; then
+    log_f "Failed to read SQL domains, retrying in 1 minute..."
+    sleep 1m
+    exec $(readlink -f "$0")
+  fi
+  while read domains; do
+    if [[ -z "${domains}" ]]; then
+      # ignore empty lines
+      continue
+    fi
+    SQL_DOMAIN_ARR+=("${domains}")
+  done <<< "${SQL_DOMAINS}"
+
+  if [[ ${ONLY_MAILCOW_HOSTNAME} != "y" ]]; then
+  for SQL_DOMAIN in "${SQL_DOMAIN_ARR[@]}"; do
+    unset VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
+    declare -a VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
+    for SUBDOMAIN in "${ADDITIONAL_WC_ARR[@]}"; do
+      if [[  "${SUBDOMAIN}.${SQL_DOMAIN}" != "${MAILCOW_HOSTNAME}" ]]; then
+        if check_domain "${SUBDOMAIN}.${SQL_DOMAIN}"; then
+          VALIDATED_CONFIG_DOMAINS_SUBDOMAINS+=("${SUBDOMAIN}.${SQL_DOMAIN}")
+        fi
+      fi
+    done
+    VALIDATED_CONFIG_DOMAINS+=("${VALIDATED_CONFIG_DOMAINS_SUBDOMAINS[*]}")
+  done
+  fi
+
+  if check_domain ${MAILCOW_HOSTNAME}; then
+    VALIDATED_MAILCOW_HOSTNAME="${MAILCOW_HOSTNAME}"
+  fi
+
+  if [[ ${ONLY_MAILCOW_HOSTNAME} != "y" ]]; then
+  for SAN in "${ADDITIONAL_SAN_ARR[@]}"; do
+    # Skip on CAA errors for SAN
+    SAN_PARENT_DOMAIN=$(echo ${SAN} | cut -d. -f2-)
+    SAN_CAAS=( $(dig CAA ${SAN_PARENT_DOMAIN} +short | sed -n 's/\d issue "\(.*\)"/\1/p') )
+    if [[ ! -z ${SAN_CAAS} ]]; then
+      if [[ ${SAN_CAAS[@]} =~ "letsencrypt.org" ]]; then
+        log_f "Validated CAA for parent domain ${SAN_PARENT_DOMAIN} of ${SAN}"
+      else
+        log_f "Skipping ACME validation for ${SAN}: Lets Encrypt disallowed for ${SAN} by CAA record"
+        continue
+      fi
+    fi
+    if [[ ${SAN} == ${MAILCOW_HOSTNAME} ]]; then
+      continue
+    fi
+    if check_domain ${SAN}; then
+      ADDITIONAL_VALIDATED_SAN+=("${SAN}")
+    fi
+  done
+  fi
+
+  # Unique domains for server certificate
+  if [[ ${ENABLE_SSL_SNI} == "y" ]]; then
+    # create certificate for server name and fqdn SANs only
+    SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
+  else
+    # create certificate for all domains, including all subdomains from other domains [*]
+    SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${VALIDATED_CONFIG_DOMAINS[*]} ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
+  fi
+  if [[ ! -z ${SERVER_SAN_VALIDATED[*]} ]]; then
+    CERT_NAME=${SERVER_SAN_VALIDATED[0]}
+    VALIDATED_CERTIFICATES+=("${CERT_NAME}")
+
+    # obtain server certificate if required
+    DOMAINS=${SERVER_SAN_VALIDATED[@]} /srv/obtain-certificate.sh rsa
+    RETURN="$?"
+    if [[ "$RETURN" == "0" ]]; then # 0 = cert created successfully
+      CERT_AMOUNT_CHANGED=1
+      CERT_CHANGED=1
+    elif [[ "$RETURN" == "1" ]]; then # 1 = cert renewed successfully
+      CERT_CHANGED=1
+    elif [[ "$RETURN" == "2" ]]; then # 2 = cert not due for renewal
+      :
+    else
+      CERT_ERRORS=1
+    fi
+    # copy hostname certificate to default/server certificate
+    # do not a key when cert is missing, this can lead to a mismatch of cert/key
+    if [[ -f ${ACME_BASE}/${CERT_NAME}/cert.pem ]]; then
+      cp ${ACME_BASE}/${CERT_NAME}/cert.pem ${ACME_BASE}/cert.pem
+      cp ${ACME_BASE}/${CERT_NAME}/key.pem ${ACME_BASE}/key.pem
+    fi
+  fi
+
+  # individual certificates for SNI [@]
+  if [[ ${ENABLE_SSL_SNI} == "y" ]]; then
+  for VALIDATED_DOMAINS in "${VALIDATED_CONFIG_DOMAINS[@]}"; do
+    VALIDATED_DOMAINS_ARR=(${VALIDATED_DOMAINS})
+
+    unset VALIDATED_DOMAINS_SORTED
+    declare -a VALIDATED_DOMAINS_SORTED
+    VALIDATED_DOMAINS_SORTED=(${VALIDATED_DOMAINS_ARR[0]} $(echo ${VALIDATED_DOMAINS_ARR[@]:1} | xargs -n1 | sort -u | xargs))
+
+    # remove all domain names that are already inside the server certificate (SERVER_SAN_VALIDATED)
+    for domain in "${SERVER_SAN_VALIDATED[@]}"; do
+      for i in "${!VALIDATED_DOMAINS_SORTED[@]}"; do
+        if [[ ${VALIDATED_DOMAINS_SORTED[i]} = $domain ]]; then
+          unset 'VALIDATED_DOMAINS_SORTED[i]'
+        fi
+      done
+    done
+
+    if [[ ! -z ${VALIDATED_DOMAINS_SORTED[*]} ]]; then
+      CERT_NAME=${VALIDATED_DOMAINS_SORTED[0]}
+      VALIDATED_CERTIFICATES+=("${CERT_NAME}")
+      # obtain certificate if required
+      DOMAINS=${VALIDATED_DOMAINS_SORTED[@]} /srv/obtain-certificate.sh rsa
+      RETURN="$?"
+      if [[ "$RETURN" == "0" ]]; then # 0 = cert created successfully
+        CERT_AMOUNT_CHANGED=1
+        CERT_CHANGED=1
+      elif [[ "$RETURN" == "1" ]]; then # 1 = cert renewed successfully
+        CERT_CHANGED=1
+      elif [[ "$RETURN" == "2" ]]; then # 2 = cert not due for renewal
+        :
+      else
+        CERT_ERRORS=1
+      fi
+    fi
+  done
+  fi
+
+  if [[ -z ${VALIDATED_CERTIFICATES[*]} ]]; then
+    log_f "Cannot validate any hostnames, skipping Let's Encrypt for 1 hour."
+    log_f "Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently."
+    ${REDIS_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
+    sleep 1h
+    exec $(readlink -f "$0")
+  fi
+
+  # find orphaned certificates if no errors occurred
+  if [[ "${CERT_ERRORS}" == "0" ]]; then
+    for EXISTING_CERT in "${EXISTING_CERTS[@]}"; do
+      if [[ ! "`printf '_%s_\n' "${VALIDATED_CERTIFICATES[@]}"`" == *"_${EXISTING_CERT}_"* ]]; then
+        DATE=$(date +%Y-%m-%d_%H_%M_%S)
+        log_f "Found orphaned certificate: ${EXISTING_CERT} - archiving it at ${ACME_BASE}/backups/${EXISTING_CERT}/"
+        BACKUP_DIR=${ACME_BASE}/backups/${EXISTING_CERT}/${DATE}
+        # archive rsa cert and any other files
+        mkdir -p ${ACME_BASE}/backups/${EXISTING_CERT}
+        mv ${ACME_BASE}/${EXISTING_CERT} ${BACKUP_DIR}
+        CERT_CHANGED=1
+        CERT_AMOUNT_CHANGED=1
+      fi
+    done
+  fi
+
+  # reload on new or changed certificates
+  if [[ "${CERT_CHANGED}" == "1" ]]; then
+    rm -f "${ACME_BASE}/force_renew" 2> /dev/null
+    RELOAD_LOOP_C=1
+    while [[ "${POSTFIX_CERT_SERIAL}" == "${POSTFIX_CERT_SERIAL_NEW}" ]] || [[ "${DOVECOT_CERT_SERIAL}" == "${DOVECOT_CERT_SERIAL_NEW}" ]] || [[ ${#POSTFIX_CERT_SERIAL_NEW} -ne 36 ]] || [[ ${#DOVECOT_CERT_SERIAL_NEW} -ne 36 ]]; do
+      log_f "Reloading or restarting services... (${RELOAD_LOOP_C})"
+      RELOAD_LOOP_C=$((RELOAD_LOOP_C + 1))
+      CERT_AMOUNT_CHANGED=${CERT_AMOUNT_CHANGED} /srv/reload-configurations.sh
+      log_f "Waiting for containers to settle..."
+      sleep 10
+      until nc -z dovecot 143; do
+        sleep 1
+      done
+      until nc -z postfix 25; do
+        sleep 1
+      done
+      POSTFIX_CERT_SERIAL_NEW="$(echo | openssl s_client -connect postfix:25 -starttls smtp 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
+      DOVECOT_CERT_SERIAL_NEW="$(echo | openssl s_client -connect dovecot:143 -starttls imap 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
+      if [[ ${RELOAD_LOOP_C} -gt 3 ]]; then
+        log_f "Some services do return old end dates, something went wrong!"
+        ${REDIS_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
+        break;
+      fi
+    done
+  fi
+
+  case "$CERT_ERRORS" in
+    0) # all successful
+      if [[ "${CERT_CHANGED}" == "1" ]]; then
+        if [[ "${CERT_AMOUNT_CHANGED}" == "1" ]]; then
+          log_f "Certificates successfully requested and renewed where required, sleeping one day"
+        else
+          log_f "Certificates were successfully renewed where required, sleeping for another day."
+        fi
+      else
+        log_f "Certificates were successfully validated, no changes or renewals required, sleeping for another day."
+      fi
+      sleep 1d
+      ;;
+    *) # non-zero
+      log_f "Some errors occurred, retrying in 30 minutes..."
+      ${REDIS_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
+      sleep 30m
+      exec $(readlink -f "$0")
+      ;;
+  esac
+
+done
diff --git a/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/expand6.sh b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/expand6.sh
new file mode 100755
index 0000000..a781722
--- /dev/null
+++ b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/expand6.sh
@@ -0,0 +1,131 @@
+#!/bin/bash
+
+##################################################################################
+#
+#  Copyright (C) 2017 Craig Miller
+#
+#  See the file "LICENSE" for information on usage and redistribution
+#  of this file, and for a DISCLAIMER OF ALL WARRANTIES.
+#  Distributed under GPLv2 License
+#
+##################################################################################
+
+
+# IPv6 Address Expansion functions
+#
+# by Craig Miller   19 Feb 2017
+#
+# 16 Nov 2017 v0.93 - added CLI functionality
+
+
+VERSION=0.93
+
+empty_addr="0000:0000:0000:0000:0000:0000:0000:0000"
+empty_addr_len=${#empty_addr}
+
+function usage {
+               echo " $0 - expand compressed IPv6 addresss "
+         echo " e.g. $0 2001:db8:1:12:123::456 "
+         echo " "
+         echo " -t  self test"
+         echo " "
+         echo " By Craig Miller - Version: $VERSION"
+         exit 1
+           }
+
+if [ "$1" == "-h" ]; then
+  #call help
+  usage
+fi
+
+#
+# Expands IPv6 quibble to 4 digits with leading zeros e.g. db8 -> 0db8
+#
+# Returns string with expanded quibble
+
+function expand_quibble() {
+  addr=$1
+  # create array of quibbles
+  addr_array=(${addr//:/ })
+  addr_array_len=${#addr_array[@]}
+  # step thru quibbles
+  for ((i=0; i< $addr_array_len ; i++ ))
+  do
+    quibble=${addr_array[$i]}
+    quibble_len=${#quibble}
+    case $quibble_len in
+      1) quibble="000$quibble";;
+      2) quibble="00$quibble";;
+      3) quibble="0$quibble";;
+    esac
+    addr_array[$i]=$quibble 
+  done
+  # reconstruct addr from quibbles
+  return_str=${addr_array[*]}
+  return_str="${return_str// /:}"
+  echo $return_str
+}
+
+#
+# Expands IPv6 address :: format to full zeros
+#
+# Returns string with expanded address
+
+function expand() {
+  if [[ $1 == *"::"* ]]; then
+    # check for leading zeros on front_addr
+    if [[ $1 == "::"* ]]; then
+      front_addr=0
+    else
+      front_addr=$(echo $1 | sed -r 's;([^ ]+)::.*;\1;') 
+    fi
+    # check for trailing zeros on back_addr
+    if [[ $1 == *"::" ]]; then
+      back_addr=0
+    else
+      back_addr=$(echo $1 | sed -r 's;.*::([^ ]+);\1;') 
+    fi
+    front_addr=$(expand_quibble $front_addr)
+    back_addr=$(expand_quibble $back_addr)
+    
+    new_addr=$empty_addr
+    front_addr_len=${#front_addr}
+    back_addr_len=${#back_addr}
+    # calculate fill needed
+    num_zeros=$(($empty_addr_len - $front_addr_len - $back_addr_len - 1))
+
+    #fill_str=${empty_addr[0]:0:$num_zeros}
+    new_addr="$front_addr:${empty_addr[0]:0:$num_zeros}$back_addr"
+    
+    # return expanded address
+    echo $new_addr
+  else
+    # return input with expandd quibbles
+    expand_quibble $1
+  fi
+}
+
+# self test - call with '-t' parameter
+if [ "$1" == "-t" ]; then
+  # add address examples to test
+  expand fd11::1d70:cf84:18ef:d056
+  expand 2a01::1
+  expand fe80::f203:8cff:fe3f:f041
+  expand 2001:db8:123::5
+  expand 2001:470:ebbd:0:f203:8cff:fe3f:f041
+  # special cases
+  expand ::1
+  expand fd32:197d:3022:1101::
+  exit 1
+fi
+
+# allow script to be sourced (with no arguements)
+if [[ $1 != "" ]]; then
+  # validate input is an IPv6 address
+  if [[ $1 == *":"* ]]; then
+    expand $1
+  else
+    echo "ERROR: unregcognized IPv6 address $1"
+    exit 1
+  fi
+fi
diff --git a/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/functions.sh b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/functions.sh
new file mode 100644
index 0000000..454946d
--- /dev/null
+++ b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/functions.sh
@@ -0,0 +1,112 @@
+#!/bin/bash
+
+log_f() {
+  if [[ ${2} == "no_nl" ]]; then
+    echo -n "$(date) - ${1}"
+  elif [[ ${2} == "no_date" ]]; then
+    echo "${1}"
+  elif [[ ${2} != "redis_only" ]]; then
+    echo "$(date) - ${1}"
+  fi
+  if [[ ${3} == "b64" ]]; then
+    ${REDIS_CMDLINE} LPUSH ACME_LOG "{\"time\":\"$(date +%s)\",\"message\":\"base64,$(printf '%s' "${MAILCOW_HOSTNAME} - ${1}")\"}" > /dev/null
+  else
+    ${REDIS_CMDLINE} LPUSH ACME_LOG "{\"time\":\"$(date +%s)\",\"message\":\"$(printf '%s' "${MAILCOW_HOSTNAME} - ${1}" | \
+      tr '%&;$"[]{}-\r\n' ' ')\"}" > /dev/null
+  fi
+}
+
+verify_hash_match(){
+  CERT_HASH=$(openssl x509 -in "${1}" -noout -pubkey | openssl md5)
+  KEY_HASH=$(openssl pkey -in "${2}" -pubout | openssl md5)
+  if [[ ${CERT_HASH} != ${KEY_HASH} ]]; then
+    log_f "Certificate and key hashes do not match!"
+    return 1
+  else
+    log_f "Verified hashes."
+    return 0
+  fi
+}
+
+get_ipv4(){
+  local IPV4=
+  local IPV4_SRCS=
+  local TRY=
+  IPV4_SRCS[0]="ip4.mailcow.email"
+  IPV4_SRCS[1]="ip4.korves.net"
+  until [[ ! -z ${IPV4} ]] || [[ ${TRY} -ge 10 ]]; do
+    IPV4=$(curl --connect-timeout 3 -m 10 -L4s ${IPV4_SRCS[$RANDOM % ${#IPV4_SRCS[@]} ]} | grep -E "^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$")
+    [[ ! -z ${TRY} ]] && sleep 1
+    TRY=$((TRY+1))
+  done
+  echo ${IPV4}
+}
+
+get_ipv6(){
+  local IPV6=
+  local IPV6_SRCS=
+  local TRY=
+  IPV6_SRCS[0]="ip6.korves.net"
+  IPV6_SRCS[1]="ip6.mailcow.email"
+  until [[ ! -z ${IPV6} ]] || [[ ${TRY} -ge 10 ]]; do
+    IPV6=$(curl --connect-timeout 3 -m 10 -L6s ${IPV6_SRCS[$RANDOM % ${#IPV6_SRCS[@]} ]} | grep "^\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}$")
+    [[ ! -z ${TRY} ]] && sleep 1
+    TRY=$((TRY+1))
+  done
+  echo ${IPV6}
+}
+
+check_domain(){
+    DOMAIN=$1
+    A_DOMAIN=$(dig A ${DOMAIN} +short | tail -n 1)
+    AAAA_DOMAIN=$(dig AAAA ${DOMAIN} +short | tail -n 1)
+    # Check if CNAME without v6 enabled target
+    if [[ ! -z ${AAAA_DOMAIN} ]] && [[ -z $(echo ${AAAA_DOMAIN} | grep "^\([0-9a-fA-F]\{0,4\}:\)\{1,7\}[0-9a-fA-F]\{0,4\}$") ]]; then
+      AAAA_DOMAIN=
+    fi
+    if [[ ! -z ${AAAA_DOMAIN} ]]; then
+      log_f "Found AAAA record for ${DOMAIN}: ${AAAA_DOMAIN} - skipping A record check"
+      if [[ $(expand ${IPV6:-"0000:0000:0000:0000:0000:0000:0000:0000"}) == $(expand ${AAAA_DOMAIN}) ]] || [[ ${SKIP_IP_CHECK} == "y" ]] || [[ ${SNAT6_TO_SOURCE} != "n" ]]; then
+        if verify_challenge_path "${DOMAIN}" 6; then
+          log_f "Confirmed AAAA record with IP $(expand ${AAAA_DOMAIN})"
+          return 0
+        else
+          log_f "Confirmed AAAA record with IP $(expand ${AAAA_DOMAIN}), but HTTP validation failed"
+        fi
+      else
+        log_f "Cannot match your IP $(expand ${IPV6:-"0000:0000:0000:0000:0000:0000:0000:0000"}) against hostname ${DOMAIN} (DNS returned $(expand ${AAAA_DOMAIN}))"
+      fi
+    elif [[ ! -z ${A_DOMAIN} ]]; then
+      log_f "Found A record for ${DOMAIN}: ${A_DOMAIN}"
+      if [[ ${IPV4:-ERR} == ${A_DOMAIN} ]] || [[ ${SKIP_IP_CHECK} == "y" ]] || [[ ${SNAT_TO_SOURCE} != "n" ]]; then
+        if verify_challenge_path "${DOMAIN}" 4; then
+          log_f "Confirmed A record ${A_DOMAIN}"
+          return 0
+        else
+          log_f "Confirmed A record with IP ${A_DOMAIN}, but HTTP validation failed"
+        fi
+      else
+        log_f "Cannot match your IP ${IPV4} against hostname ${DOMAIN} (DNS returned ${A_DOMAIN})"
+      fi
+    else
+      log_f "No A or AAAA record found for hostname ${DOMAIN}"
+    fi
+    return 1
+}
+
+verify_challenge_path(){
+  if [[ ${SKIP_HTTP_VERIFICATION} == "y" ]]; then
+    echo '(skipping check, returning 0)'
+    return 0
+  fi
+  # verify_challenge_path URL 4|6
+  RANDOM_N=${RANDOM}${RANDOM}${RANDOM}
+  echo ${RANDOM_N} > /var/www/acme/${RANDOM_N}
+  if [[ "$(curl --insecure -${2} -L http://${1}/.well-known/acme-challenge/${RANDOM_N} --silent)" == "${RANDOM_N}"  ]]; then
+    rm /var/www/acme/${RANDOM_N}
+    return 0
+  else
+    rm /var/www/acme/${RANDOM_N}
+    return 1
+  fi
+}
diff --git a/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/obtain-certificate.sh b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/obtain-certificate.sh
new file mode 100644
index 0000000..8264a2c
--- /dev/null
+++ b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/obtain-certificate.sh
@@ -0,0 +1,130 @@
+#!/bin/bash
+
+# Return values / exit codes
+# 0 = cert created successfully
+# 1 = cert renewed successfully
+# 2 = cert not due for renewal
+# * = errors
+
+
+source /srv/functions.sh
+
+CERT_DOMAINS=(${DOMAINS[@]})
+CERT_DOMAIN=${CERT_DOMAINS[0]}
+ACME_BASE=/var/lib/acme
+
+TYPE=${1}
+PREFIX=""
+# only support rsa certificates for now
+if [[ "${TYPE}" != "rsa" ]]; then
+  log_f "Unknown certificate type '${TYPE}' requested"
+  exit 5
+fi
+DOMAINS_FILE=${ACME_BASE}/${CERT_DOMAIN}/domains
+CERT=${ACME_BASE}/${CERT_DOMAIN}/${PREFIX}cert.pem
+SHARED_KEY=${ACME_BASE}/acme/${PREFIX}key.pem  # must already exist
+KEY=${ACME_BASE}/${CERT_DOMAIN}/${PREFIX}key.pem
+CSR=${ACME_BASE}/${CERT_DOMAIN}/${PREFIX}acme.csr
+
+if [[ -z ${CERT_DOMAINS[*]} ]]; then
+  log_f "Missing CERT_DOMAINS to obtain a certificate"
+  exit 3
+fi
+
+if [[ "${LE_STAGING}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+  if [[ ! -z "${DIRECTORY_URL}" ]]; then
+    log_f "Cannot use DIRECTORY_URL with LE_STAGING=y - ignoring DIRECTORY_URL"
+  fi
+  log_f "Using Let's Encrypt staging servers"
+  DIRECTORY_URL='--directory-url https://acme-staging-v02.api.letsencrypt.org/directory'
+elif [[ ! -z "${DIRECTORY_URL}" ]]; then
+  log_f "Using custom directory URL ${DIRECTORY_URL}"
+  DIRECTORY_URL="--directory-url ${DIRECTORY_URL}"
+fi
+
+if [[ -f ${DOMAINS_FILE} && "$(cat ${DOMAINS_FILE})" ==  "${CERT_DOMAINS[*]}" ]]; then
+  if [[ ! -f ${CERT} || ! -f "${KEY}" || -f "${ACME_BASE}/force_renew" ]]; then
+    log_f "Certificate ${CERT} doesn't exist yet or forced renewal - start obtaining"
+  # Certificate exists and did not change but could be due for renewal (30 days)
+  elif ! openssl x509 -checkend 2592000 -noout -in ${CERT} > /dev/null; then
+    log_f "Certificate ${CERT} is due for renewal (< 30 days) - start renewing"
+  else
+    log_f "Certificate ${CERT} validation done, neither changed nor due for renewal."
+    exit 2
+  fi
+else
+  log_f "Certificate ${CERT} missing or changed domains '${CERT_DOMAINS[*]}' - start obtaining"
+fi
+
+
+# Make backup
+if [[ -f ${CERT} ]]; then
+  DATE=$(date +%Y-%m-%d_%H_%M_%S)
+  BACKUP_DIR=${ACME_BASE}/backups/${CERT_DOMAIN}/${PREFIX}${DATE}
+  log_f "Creating backups in ${BACKUP_DIR} ..."
+  mkdir -p ${BACKUP_DIR}/
+  [[ -f ${DOMAINS_FILE} ]] && cp ${DOMAINS_FILE} ${BACKUP_DIR}/
+  [[ -f ${CERT} ]] && cp ${CERT} ${BACKUP_DIR}/
+  [[ -f ${KEY} ]] && cp ${KEY} ${BACKUP_DIR}/
+  [[ -f ${CSR} ]] && cp ${CSR} ${BACKUP_DIR}/
+fi
+
+mkdir -p ${ACME_BASE}/${CERT_DOMAIN}
+if [[ ! -f ${KEY} ]]; then
+  log_f "Copying shared private key for this certificate..."
+  cp ${SHARED_KEY} ${KEY}
+  chmod 600 ${KEY}
+fi
+
+# Generating CSR
+printf "[SAN]\nsubjectAltName=" > /tmp/_SAN
+printf "DNS:%s," "${CERT_DOMAINS[@]}" >> /tmp/_SAN
+sed -i '$s/,$//' /tmp/_SAN
+openssl req -new -sha256 -key ${KEY} -subj "/" -reqexts SAN -config <(cat /etc/ssl/openssl.cnf /tmp/_SAN) > ${CSR}
+
+# acme-tiny writes info to stderr and ceritifcate to stdout
+# The redirects will do the following:
+# - redirect stdout to temp certificate file
+# - redirect acme-tiny stderr to stdout (logs to variable ACME_RESPONSE)
+# - tee stderr to get live output and log to dockerd
+
+log_f "Checking resolver..."
+until dig letsencrypt.org +time=3 +tries=1 @unbound > /dev/null; do
+  sleep 2
+done
+log_f "Resolver OK"
+
+ACME_RESPONSE=$(acme-tiny ${DIRECTORY_URL} \
+  --account-key ${ACME_BASE}/acme/account.pem \
+  --disable-check \
+  --csr ${CSR} \
+  --acme-dir /var/www/acme/ 2>&1 > /tmp/_cert.pem | tee /dev/fd/5; exit ${PIPESTATUS[0]})
+SUCCESS="$?"
+ACME_RESPONSE_B64=$(echo "${ACME_RESPONSE}" | openssl enc -e -A -base64)
+log_f "${ACME_RESPONSE_B64}" redis_only b64
+case "$SUCCESS" in
+  0) # cert requested
+    log_f "Deploying certificate ${CERT}..."
+    # Deploy the new certificate and key
+    # Moving temp cert to {domain} folder
+    if verify_hash_match /tmp/_cert.pem ${KEY}; then
+      RETURN=0  # certificate created
+      if [[ -f ${CERT} ]]; then
+        RETURN=1  # certificate renewed
+      fi
+      mv -f /tmp/_cert.pem ${CERT}
+      echo -n ${CERT_DOMAINS[*]} > ${DOMAINS_FILE}
+      rm /var/www/acme/* 2> /dev/null
+      log_f "Certificate successfully obtained"
+      exit ${RETURN}
+    else
+      log_f "Certificate was successfully requested, but key and certificate have non-matching hashes, ignoring certificate"
+      exit 4
+    fi
+    ;;
+  *) # non-zero is non-fun
+    log_f "Failed to obtain certificate ${CERT} for domains '${CERT_DOMAINS[*]}'"
+    redis-cli -h redis SET ACME_FAIL_TIME "$(date +%s)"
+    exit 100${SUCCESS}
+    ;;
+esac
diff --git a/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/reload-configurations.sh b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/reload-configurations.sh
new file mode 100644
index 0000000..d5461a4
--- /dev/null
+++ b/mailcow/src/mailcow-dockerized/data/Dockerfiles/acme/reload-configurations.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+# Reading container IDs
+# Wrapping as array to ensure trimmed content when calling $NGINX etc.
+NGINX=($(curl --silent --insecure https://dockerapi/containers/json | jq -r ".[] | {name: .Config.Labels[\"com.docker.compose.service\"], project: .Config.Labels[\"com.docker.compose.project\"], id: .Id}" | jq -rc "select( .name | tostring | contains(\"nginx-mailcow\")) | select( .project | tostring | contains(\"${COMPOSE_PROJECT_NAME,,}\")) | .id" | tr "\n" " "))
+DOVECOT=($(curl --silent --insecure https://dockerapi/containers/json | jq -r ".[] | {name: .Config.Labels[\"com.docker.compose.service\"], project: .Config.Labels[\"com.docker.compose.project\"], id: .Id}" | jq -rc "select( .name | tostring | contains(\"dovecot-mailcow\")) | select( .project | tostring | contains(\"${COMPOSE_PROJECT_NAME,,}\")) | .id" | tr "\n" " "))
+POSTFIX=($(curl --silent --insecure https://dockerapi/containers/json | jq -r ".[] | {name: .Config.Labels[\"com.docker.compose.service\"], project: .Config.Labels[\"com.docker.compose.project\"], id: .Id}" | jq -rc "select( .name | tostring | contains(\"postfix-mailcow\")) | select( .project | tostring | contains(\"${COMPOSE_PROJECT_NAME,,}\")) | .id" | tr "\n" " "))
+
+reload_nginx(){
+  echo "Reloading Nginx..."
+  NGINX_RELOAD_RET=$(curl -X POST --insecure https://dockerapi/containers/${NGINX}/exec -d '{"cmd":"reload", "task":"nginx"}' --silent -H 'Content-type: application/json' | jq -r .type)
+  [[ ${NGINX_RELOAD_RET} != 'success' ]] && { echo "Could not reload Nginx, restarting container..."; restart_container ${NGINX} ; }
+}
+
+reload_dovecot(){
+  echo "Reloading Dovecot..."
+  DOVECOT_RELOAD_RET=$(curl -X POST --insecure https://dockerapi/containers/${DOVECOT}/exec -d '{"cmd":"reload", "task":"dovecot"}' --silent -H 'Content-type: application/json' | jq -r .type)
+  [[ ${DOVECOT_RELOAD_RET} != 'success' ]] && { echo "Could not reload Dovecot, restarting container..."; restart_container ${DOVECOT} ; }
+}
+
+reload_postfix(){
+  echo "Reloading Postfix..."
+  POSTFIX_RELOAD_RET=$(curl -X POST --insecure https://dockerapi/containers/${POSTFIX}/exec -d '{"cmd":"reload", "task":"postfix"}' --silent -H 'Content-type: application/json' | jq -r .type)
+  [[ ${POSTFIX_RELOAD_RET} != 'success' ]] && { echo "Could not reload Postfix, restarting container..."; restart_container ${POSTFIX} ; }
+}
+
+restart_container(){
+  for container in $*; do
+    echo "Restarting ${container}..."
+    C_REST_OUT=$(curl -X POST --insecure https://dockerapi/containers/${container}/restart --silent | jq -r '.msg')
+    echo "${C_REST_OUT}"
+  done
+}
+
+if [[ "${CERT_AMOUNT_CHANGED}" == "1" ]]; then
+  restart_container ${NGINX}
+  restart_container ${DOVECOT}
+  restart_container ${POSTFIX}
+else
+  reload_nginx
+  #reload_dovecot
+  restart_container ${DOVECOT}
+  #reload_postfix
+  restart_container ${POSTFIX}
+fi