# Automatic subdomain letsencrypt certificates with wildcard fallback for non-SNI

**URL:** <https://community.traefik.io/t/automatic-subdomain-letsencrypt-certificates-with-wildcard-fallback-for-non-sni/11959>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme, docker\
**Created:** [October 2, 2021, 1:06pm UTC](https://community.traefik.io/t/automatic-subdomain-letsencrypt-certificates-with-wildcard-fallback-for-non-sni/11959 "2021-10-02T13:06:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![phirestalker](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/phirestalker/32/5370_2.png) [@phirestalker](https://community.traefik.io/u/phirestalker)\
**Post date:** [October 2, 2021, 1:06pm UTC](https://community.traefik.io/t/automatic-subdomain-letsencrypt-certificates-with-wildcard-fallback-for-non-sni/11959/1 "2021-10-02T13:06:52Z")

</div>

I currently have a handful of services working with Traefik on a docker host. It is configured to automatically generate and renew certificates for each subdomain configured through labels in the docker-compose files. This is working great, but I would like to increase my security and compatibility.

I have recently been testing on ssllabs and noticed that in some circumstances the "Traefik default" cert is used. I would like to have a wildcard cert on my domain that can be used in place of the default cert in these circumstances. The twist? I want Traefik to handle the renewal of this cert as well and only serve it as a backup to the specific subdomain certs.

I have tried searching, but I can't seem to find the right terms.

Does anyone know how I can achieve this?

---

<div class="post-metadata">

**Author:** ![phirestalker](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/phirestalker/32/5370_2.png) [@phirestalker](https://community.traefik.io/u/phirestalker)\
**Post date:** [October 4, 2021, 9:35pm UTC](https://community.traefik.io/t/automatic-subdomain-letsencrypt-certificates-with-wildcard-fallback-for-non-sni/11959/2 "2021-10-04T21:35:27Z")

</div>

Nevermind, got it sorted.

---

<div class="post-metadata">

**Author:** ![jakubhajek](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jakubhajek/32/3389_2.png) [@jakubhajek](https://community.traefik.io/u/jakubhajek)\
**Post date:** [October 7, 2021, 11:59am UTC](https://community.traefik.io/t/automatic-subdomain-letsencrypt-certificates-with-wildcard-fallback-for-non-sni/11959/3 "2021-10-07T11:59:10Z")

</div>

Hello @phirestalker

thanks for asking the question and glad that you have found the solution. Would you please share with the community how did you solve it?

Thank you,

---

<div class="post-metadata">

**Author:** ![phirestalker](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/phirestalker/32/5370_2.png) [@phirestalker](https://community.traefik.io/u/phirestalker)\
**Post date:** [October 7, 2021, 1:18pm UTC](https://community.traefik.io/t/automatic-subdomain-letsencrypt-certificates-with-wildcard-fallback-for-non-sni/11959/4 "2021-10-07T13:18:46Z")

</div>

I'm not sure how well it will come out because I am copying from a terminal, but here goes.

First, I set up a wildcard cert for my domain with a few labels in my Traefik docker-compose file.

```auto
      - "traefik.http.routers.wildcard-certs.rule=Host(`*.example.com`)"
      - "traefik.http.routers.wildcard-certs.tls.certresolver=myresolver"
      - "traefik.http.routers.wildcard-certs.tls.domains[0].main=example.com"
      - "traefik.http.routers.wildcard-certs.tls.domains[0].sans=*.example.com"

```

Now, as we all know, this only adds the cert info to the infamous acme.json file. The default certificate setting for Traefik, however, only accepts certificate files. After some searching for a way to export these certs, I landed upon an interesting piece of software called [traefik-certs-dumper](https://github.com/ldez/traefik-certs-dumper/tree/master). I used the default settings offered in the v2 example file and added this to the services section of my docker-compose file for Traefik.

```auto
  traefik-certs-dumper:
    image: ldez/traefik-certs-dumper:latest
    entrypoint: sh -c '
      apk add jq
      ; while ! [-e /data/acme.json]
      || ! [`jq ".[] | .Certificates | length" /data/acme.json` != 0 ]; do
      sleep 1
      ; done
      && traefik-certs-dumper file --version v2 --watch --domain-subdir=true
      --source /data/acme.json --dest /data/certs'
    volumes:
      - ./letsencrypt:/data

```

The bind mount is the same directory that my Traefik docker container uses to store acme.json  
Then, I added the config to use the exported certificate as the default certificate in my Traefik dynamic configuration as follows.

```auto
[tls]
  [tls.stores]
    [tls.stores.default]
      [tls.stores.default.defaultCertificate]
        certFile = "/letsencrypt/certs/example.com/certificate.crt"
        keyFile = "/letsencrypt/certs/example.com/privatekey.key"

```

And now, SSL Labs reports that my site works with non-SNI clients. Also, no more self-signed Traefik default cert.

I know I could have just used a wildcard cert for all of my docker containers, but I read somewhere that wildcard certs are incompatible with some advanced security settings (sorry I don't have the link).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [October 10, 2021, 1:19pm UTC](https://community.traefik.io/t/automatic-subdomain-letsencrypt-certificates-with-wildcard-fallback-for-non-sni/11959/5 "2021-10-10T13:19:01Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.