# Cannot get ACME client get directory - dial tcp: lookup acme-v02.api.letsencrypt.org on 127.0.0.11:53: server misbehaving

**URL:** <https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [January 3, 2024, 2:33pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965 "2024-01-03T14:33:06Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![pixel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/pixel/32/4484_2.png) [@pixel](https://community.traefik.io/u/pixel)\
**Post date:** [January 3, 2024, 2:33pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/1 "2024-01-03T14:33:06Z")

</div>

Hey there,

I might be to dumb to configure traefik.

I get the following error:

```auto
time="2024-01-03T13:43:10Z" level=error msg="Unable to obtain ACME certificate for domains \"pyload.dyn.example.com\": cannot get ACME client get directory at 'https://acme-v02.api.letsencrypt.org/directory': Get \"https://acme-v02.api.letsencrypt.org/directory\": dial tcp: lookup acme-v02.api.letsencrypt.org on 127.0.0.11:53: server misbehaving" routerName=pyload@docker providerName=letsencrypt.acme rule="Host(`pyload.dyn.example.com`)"

```

I guess this is the key here: `127.0.0.11:53: server misbehaving`

My setup looks like this:  
I am running traefik on a RasPi behind a Fritzbox as router and with a pi-hole on the RasPi as well.  
My goal is it to run multiple services on the RasPi and use traefik as reverse proxy with SSL.  
But so far I am not lucky at all.  
This is my config:

docker-compose.yml of traefik:

```auto
version: "2.1"
services:
  traefik:
    container_name: traefik
    image: traefik:v2.2
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config/traefik.yml:/etc/traefik/traefik.yml
      - ./config/acme.json:/acme.json
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`traefik.dyn.example.com`)"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.tls=true"
      - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
    extra_hosts:
      - host.docker.internal:172.17.0.1

```

The traefik.yml

```auto
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"

api:
  dashboard: true
  insecure: true

providers:
  docker:
    exposedByDefault: false
    network: pi_default

certificatesResolvers:
  letsencrypt:
    acme:
      email: mail@example.com
      storage: acme.json
      httpChallenge:
        entryPoint: web

```

docker-compose.yml of pyload:

```auto
version: "2.1"
services:
  pyload-ng:
    image: lscr.io/linuxserver/pyload-ng:latest
    container_name: pyload-ng
    network_mode: 'host'
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
    volumes:
      - ./config:/config
      - /media/terrastore/downloads:/downloads
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pyload.rule=Host(`pyload.dyn.example.com`)"
      - "traefik.http.routers.pyload.entrypoints=websecure"
      - "traefik.http.routers.pyload.tls=true"
      - "traefik.http.routers.pyload.tls.certresolver=letsencrypt"
      - "traefik.http.services.pyload.loadbalancer.server.port=8000"

```

Any idea what I did wrong here?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 3, 2024, 4:46pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/2 "2024-01-03T16:46:08Z")

</div>

Port 53 is DNS so the DNS resolution is probably not working inside Traefik container.

Why do you use a multi-year old Traefik version?

Do you know what you are doing with this?

```auto
extra_hosts:
      - host.docker.internal:172.17.0.1

```

---

<div class="post-metadata">

**Author:** ![pixel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/pixel/32/4484_2.png) [@pixel](https://community.traefik.io/u/pixel)\
**Post date:** [January 3, 2024, 5:28pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/3 "2024-01-03T17:28:21Z")

</div>

well I just copied that from a website without checking the version. my bad.

In my other Docker Containers I did not specify a network. so I used `network_mode: 'host'`  
In order to do so, I needed this `extra_hosts` line to make everything work. At least that's what I thought of.

What might be the cause of the DNS resolution error? Is this really inside of Traefik or might this have something to do with pi-hole?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 3, 2024, 5:51pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/4 "2024-01-03T17:51:50Z")

</div>

Maybe check and compare to this [simple Traefik example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt).

---

<div class="post-metadata">

**Author:** ![pixel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/pixel/32/4484_2.png) [@pixel](https://community.traefik.io/u/pixel)\
**Post date:** [January 3, 2024, 5:59pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/5 "2024-01-03T17:59:50Z")

</div>

I just did and got the same error:

```auto
traefik-traefik-1 | 2024-01-03T17:58:29Z ERR Unable to obtain ACME certificate for domains error="cannot get ACME client get directory at 'https://acme-v02.api.letsencrypt.org/directory': Get \"https://acme-v02.api.letsencrypt.org/directory\": dial tcp: lookup acme-v02.api.letsencrypt.org on 127.0.0.11:53: server misbehaving" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["traefik.dyn.example.com"] providerName=myresolver.acme routerName=mydashboard@docker rule=Host(`traefik.dyn.example.com`)

```

---

<div class="post-metadata">

**Author:** ![pixel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/pixel/32/4484_2.png) [@pixel](https://community.traefik.io/u/pixel)\
**Post date:** [January 3, 2024, 6:29pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/6 "2024-01-03T18:29:48Z")

</div>

I added a DNS Server to the docker-compose of traefik manually.  
Now the error has changed:

```auto
traefik-traefik-1 | 2024-01-03T18:22:17Z ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [traefik.dyn.example.com]: error: one or more domains had a problem:\n[traefik.dyn.example.com] acme: error: 400 :: urn:ietf:params:acme:error:connection :: 2a02:810b:0:9:40c7: Error getting validation data\n" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["traefik.dyn.example.com"] providerName=myresolver.acme routerName=mydashboard@docker rule=Host(`traefik.dyn.example.com`)

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 3, 2024, 7:45pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/7 "2024-01-03T19:45:42Z")

</div>

Does `traefik.dyn.example.com` point to the IP of your node with the Traefik instance?

---

<div class="post-metadata">

**Author:** ![pixel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/pixel/32/4484_2.png) [@pixel](https://community.traefik.io/u/pixel)\
**Post date:** [January 4, 2024, 10:03am UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/8 "2024-01-04T10:03:47Z")

</div>

Yes, I have a wildcard for \*.dyn.example.com

This is the `nslookup`

```auto
nslookup traefik.dyn.example.com
Server: 10.10.1.27
Address:	10.10.1.27#53

Non-authoritative answer:
traefik.dyn.example.com canonical name = xxx.myfritz.net.
Name:	xxx.myfritz.net
Address: 77.xx.xx.xx
Name:	xxx.myfritz.net
Address: 2a02:xxxx:x:x:xxxx:xxxx:xxxx:xxxx

```

The Ports 80, 443 and 8080 get directed to the RasPi

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 4, 2024, 11:49am UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/9 "2024-01-04T11:49:21Z")

</div>

What do you mean by you "have a wildcard" for `*.dyn.example.com`? Was it created by Traefik LetsEncrypt and can now be found in `acme.json`?

---

<div class="post-metadata">

**Author:** ![pixel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/pixel/32/4484_2.png) [@pixel](https://community.traefik.io/u/pixel)\
**Post date:** [January 4, 2024, 1:33pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/10 "2024-01-04T13:33:12Z")

</div>

sorry, I was not talking about wildcard certificates. I should have been more clear on that.  
I mean, that I have a wildcard dns a record for the domain.  
So all subdomains of [dyn.example.com](http://dyn.example.com) will be redirected to my router and with that to my RasPi.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 4, 2024, 1:45pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/11 "2024-01-04T13:45:43Z")

</div>

Try the [simple Traefik example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt) on your Pi.

---

<div class="post-metadata">

**Author:** ![pixel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/pixel/32/4484_2.png) [@pixel](https://community.traefik.io/u/pixel)\
**Post date:** [January 4, 2024, 4:21pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/12 "2024-01-04T16:21:27Z")

</div>

I already did that, yesterday with the same results.

This is my current docker-compose.yml

```auto

services:
  traefik:
    image: traefik:v3.0
    ports:
      - 80:80
      - 443:443
    networks:
      - proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt:/letsencrypt
      #- /var/log:/var/log
    command:
      - --api.dashboard=true
      - --log.level=INFO
      #- --log.filepath=/var/log/traefik.log
      - --accesslog=true
      #- --accesslog.filepath=/var/log/traefik-access.log
      - --providers.docker.network=proxy
      - --providers.docker.exposedByDefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entryPoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.asDefault=true
      - --entrypoints.websecure.http.tls.certresolver=myresolver
      - --certificatesresolvers.myresolver.acme.email=mail@example.com
      - --certificatesresolvers.myresolver.acme.tlschallenge=true
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
    labels:
      - traefik.enable=true
      - traefik.http.routers.mydashboard.rule=Host(`traefik.dyn.example.com`)
      - traefik.http.routers.mydashboard.service=api@internal
      - traefik.http.routers.mydashboard.middlewares=myauth
      - traefik.http.middlewares.myauth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/

    dns:
      - 8.8.8.8
      - 1.1.1.1

  whoami:
    image: traefik/whoami:v1.8
    networks:
      - proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.mywhoami.rule=Host(`whoami.dyn.example.com`) || Host(`www.whoami.dyn.example.com`)
      - traefik.http.services.mywhoami.loadbalancer.server.port=80

      - traefik.http.middlewares.mywwwredirect.redirectregex.regex=^https://www\.(.*)
      - traefik.http.middlewares.mywwwredirect.redirectregex.replacement=https://$${1}
      - traefik.http.routers.mywhoami.middlewares=mywwwredirect

networks:
  proxy:
    name: proxy

volumes:
  letsencrypt:
    name: letsencrypt

```

And this is the error I get:

```auto
traefik-traefik-1 | 2024-01-03T18:22:17Z ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [traefik.dyn.example.com]: error: one or more domains had a problem:\n[traefik.dyn.example.com] acme: error: 400 :: urn:ietf:params:acme:error:connection :: 2a02:810b:0:9:40c7: Error getting validation data\n" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["traefik.dyn.example.com"] providerName=myresolver.acme routerName=mydashboard@docker rule=Host(`traefik.dyn.example.com`)

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 4, 2024, 4:33pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/13 "2024-01-04T16:33:14Z")

</div>

Seems Traefik LetsEncrypt is trying to validate the token itself via an IPv6 address first.

Does `traefik.dyn.example.com` have an IPv6 address and is it pointing to Fritzbox/Traefik?

Have you tried to access `https://traefik.dyn.example.com` with your browser?

---

<div class="post-metadata">

**Author:** ![pixel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/pixel/32/4484_2.png) [@pixel](https://community.traefik.io/u/pixel)\
**Post date:** [January 4, 2024, 5:01pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/14 "2024-01-04T17:01:49Z")

</div>

ok, so I just found out that I might have to reconfigure the portforwarding of the fritzbox, in order to direct traffic on port 80 and 443 to the RasPi.

I just did some changes on the fritzbox as well as on the DNS record of the domain.  
I will update as soon as I have results

---

<div class="post-metadata">

**Author:** ![pixel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/pixel/32/4484_2.png) [@pixel](https://community.traefik.io/u/pixel)\
**Post date:** [January 4, 2024, 6:42pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/15 "2024-01-04T18:42:02Z")

</div>

Alright, I am able to get access to traefik and whoami through the domains.  
However it only works with the traefik certificate and not with letsencrypt.

I am still getting the following error:

```auto
traefik-traefik-1 | 2024-01-04T18:38:12Z ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [traefik.dyn.example.com]: error: one or more domains had a problem:\n[traefik.dyn.example.com] acme: error: 400 :: urn:ietf:params:acme:error:connection :: 2a02:8106:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx: Error getting validation data\n" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["traefik.dyn.example.com"] providerName=myresolver.acme routerName=mydashboard@docker rule=Host(`traefik.dyn.example.com`)

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 4, 2024, 7:07pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/16 "2024-01-04T19:07:42Z")

</div>

Traefik is resolving the domain to an IPv6 and then trying to connect to verify, that doesn’t work.

---

<div class="post-metadata">

**Author:** ![pixel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/pixel/32/4484_2.png) [@pixel](https://community.traefik.io/u/pixel)\
**Post date:** [January 4, 2024, 9:09pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/17 "2024-01-04T21:09:00Z")

</div>

Alright, I switched from tls-challenge to dns-challenge and now it's working.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 4, 2024, 9:14pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/18 "2024-01-04T21:14:03Z")

</div>

You are welcome, always happy to help and spend my time here 😃

---

<div class="post-metadata">

**Author:** ![pixel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/pixel/32/4484_2.png) [@pixel](https://community.traefik.io/u/pixel)\
**Post date:** [January 4, 2024, 9:23pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/19 "2024-01-04T21:23:52Z")

</div>

Thank you so much 😃  
That was really helpful

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [January 7, 2024, 9:24pm UTC](https://community.traefik.io/t/cannot-get-acme-client-get-directory-dial-tcp-lookup-acme-v02-api-letsencrypt-org-on-127-0-0-11-server-misbehaving/20965/20 "2024-01-07T21:24:12Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.