# ACME Default Certificate does not work

**URL:** <https://community.traefik.io/t/acme-default-certificate-does-not-work/21417>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme, docker\
**Created:** [February 8, 2024, 4:09pm UTC](https://community.traefik.io/t/acme-default-certificate-does-not-work/21417 "2024-02-08T16:09:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![odinos](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/odinos/32/8235_2.png) [@odinos](https://community.traefik.io/u/odinos)\
**Post date:** [February 8, 2024, 4:09pm UTC](https://community.traefik.io/t/acme-default-certificate-does-not-work/21417/1 "2024-02-08T16:09:23Z")

</div>

I have set up a default certificate as described in the [docs](https://doc.traefik.io/traefik/https/tls/#acme-default-certificate). But I'm still served with the TRAEFIK DEFAULT CERT when I visit my IP directly without SNI, or an invalid subdomain. What did I do wrong?

**Static config:**

```auto
certificatesResolvers:
  le:
    acme:
      email: "letsencrypt@example.com"
      storage: "acme.json"
      tlsChallenge: {}

tls:
  stores:
    default:
      defaultGeneratedCert:
        resolver: le
        domain:
          main: example.com
          sans:
            - "*.example.com"

```

No errors in my logs.  
`level=info msg="Configuration loaded from file: /traefik.yml"`

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [February 8, 2024, 6:40pm UTC](https://community.traefik.io/t/acme-default-certificate-does-not-work/21417/2 "2024-02-08T18:40:26Z")

</div>

You use `tlsChallenge`, but for wildcard TLS certs you need to use `dnsChallenge`.