# Cannot retrieve the ACME challenge

**URL:** <https://community.traefik.io/t/cannot-retrieve-the-acme-challenge/27350>\
**Category:** Traefik v3 (latest)\
**Tags:** letsencrypt-acme\
**Created:** [April 28, 2025, 6:47pm UTC](https://community.traefik.io/t/cannot-retrieve-the-acme-challenge/27350 "2025-04-28T18:47:03Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![juxeii](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/juxeii/32/7485_2.png) [@juxeii](https://community.traefik.io/u/juxeii)\
**Post date:** [April 28, 2025, 6:47pm UTC](https://community.traefik.io/t/cannot-retrieve-the-acme-challenge/27350/1 "2025-04-28T18:47:03Z")

</div>

Hi,

I am using [pangolin](https://github.com/fosrl/pangolin) as a tunneling provider.  
They are using `traefik` under the hood.  
After a standard installation I see these errors in the `traefik` logs:

```auto
2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Loading plugins... | 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Loading plugins... | plugins=["geoblock","badger","crowdsec"]
2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Plugins loaded. | 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Plugins loaded. | plugins=["geoblock","badger","crowdsec"]
2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Starting provider aggregator *aggregator.ProviderAggregator 
2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Starting provider *file.Provider 
2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Starting provider *traefik.Provider 
2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Starting provider *http.Provider 
2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Starting provider *acme.ChallengeTLSALPN 
2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Starting provider *acme.Provider 
2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Testing certificate renew... | 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Testing certificate renew... | providerName=letsencrypt.acme 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Testing certificate renew... | 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF 2025-04-28T11:12:43Z 2025-04-28T11:12:43Z INF Testing certificate renew... | providerName=letsencrypt.acme acmeCA=https://acme-v02.api.letsencrypt.org/directory

2025-04-28T15:46:39Z ERR Cannot retrieve the ACME challenge for mail.example.org (token "index.php") | providerName=acme

2025-04-28T15:46:40Z ERR Cannot retrieve the ACME challenge for mail.example.org (token "autoload_classmap.php") | providerName=acme

2025-04-28T15:46:43Z ERR Cannot retrieve the ACME challenge for mail.example.org (token "admin.php") | providerName=acme

2025-04-28T15:46:43Z ERR Cannot retrieve the ACME challenge for mail.example.org (token "makeasmtp.php") | providerName=acme

2025-04-28T15:46:49Z ERR Cannot retrieve the ACME challenge for mail.example.org (token "radio.php") | providerName=acme

2025-04-28T15:46:52Z ERR Cannot retrieve the ACME challenge for mail.example.org (token "plugins.php") | providerName=acme

2025-04-28T15:47:00Z ERR Cannot retrieve the ACME challenge for mail.example.org (token "cloud.php") | providerName=acme

2025-04-28T15:47:16Z ERR Cannot retrieve the ACME challenge for mail.example.org (token "xmrlpc.php") | providerName=acme

2025-04-28T15:53:34Z ERR Cannot retrieve the ACME challenge for cpcontacts.example.org (token "index.php") | providerName=acme

2025-04-28T15:53:35Z ERR Cannot retrieve the ACME challenge for cpcontacts.example.org (token "autoload_classmap.php") | providerName=acme

2025-04-28T15:53:37Z ERR Cannot retrieve the ACME challenge for cpcontacts.example.org (token "admin.php") | providerName=acme

2025-04-28T15:53:38Z ERR Cannot retrieve the ACME challenge for cpcontacts.example.org (token "makeasmtp.php") | providerName=acme

2025-04-28T15:53:41Z ERR Cannot retrieve the ACME challenge for cpcontacts.example.org (token "radio.php") | providerName=acme

2025-04-28T15:53:44Z ERR Cannot retrieve the ACME challenge for cpcontacts.example.org (token "plugins.php") | providerName=acme

2025-04-28T15:53:51Z ERR Cannot retrieve the ACME challenge for cpcontacts.example.org (token "cloud.php") | providerName=acme

2025-04-28T15:53:59Z ERR Cannot retrieve the ACME challenge for cpcontacts.example.org (token "xmrlpc.php") | providerName=acme

2025-04-28T16:25:18Z ERR Cannot retrieve the ACME challenge for johndoe.com (token "cloud.php") | providerName=acme

2025-04-28T16:25:19Z ERR Cannot retrieve the ACME challenge for johndoe.com (token "xmrlpc.php") | providerName=acme

2025-04-28T16:25:20Z ERR Cannot retrieve the ACME challenge for johndoe.com (token "sx.php") | providerName=acme

2025-04-28T16:25:21Z ERR Cannot retrieve the ACME challenge for johndoe.com (token "xmrlpc.php") | providerName=acme

2025-04-28T16:25:21Z ERR Cannot retrieve the ACME challenge for johndoe.com (token "about.php") | providerName=acme

2025-04-28T17:13:08Z ERR Cannot retrieve the ACME challenge for example.org (token "cloud.php") | providerName=acme

2025-04-28T17:13:16Z ERR Cannot retrieve the ACME challenge for example.org (token "xmrlpc.php") | providerName=acme

2025-04-28T17:13:18Z ERR Cannot retrieve the ACME challenge for example.org (token "sx.php") | providerName=acme

2025-04-28T17:13:19Z ERR Cannot retrieve the ACME challenge for example.org (token "xmrlpc.php") | providerName=acme

2025-04-28T17:13:20Z ERR Cannot retrieve the ACME challenge for example.org (token "about.php") | providerName=acme

```

Any idea what this is and what it means?  
I have two root domains, `example.org` and `johndoe.com`.  
In `Cloudflare` I have setup DNS entries, with both domains having wildcards \* for any subdomain.  
I have no idea where the sudomains `mail` and `cpcontacts` come from.  
Never used them and never set them up in any way.

Is there any way to debug this?  
The guys over at `Pangoling` have no idea where this comes from either.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [April 28, 2025, 8:50pm UTC](https://community.traefik.io/t/cannot-retrieve-the-acme-challenge/27350/2 "2025-04-28T20:50:46Z")

</div>

Those are probably URLs (paths) with known vulnerabilities that get probed by bots from the Internet.

---

<div class="post-metadata">

**Author:** ![juxeii](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/juxeii/32/7485_2.png) [@juxeii](https://community.traefik.io/u/juxeii)\
**Post date:** [April 29, 2025, 7:41pm UTC](https://community.traefik.io/t/cannot-retrieve-the-acme-challenge/27350/3 "2025-04-29T19:41:17Z")

</div>

How can bots kick off a ACME challange?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [April 29, 2025, 7:57pm UTC](https://community.traefik.io/t/cannot-retrieve-the-acme-challenge/27350/4 "2025-04-29T19:57:20Z")

</div>

The bots simply hit your Traefik with URL requests. Not sure why Traefik thinks those are external LetsEncrypt validation requests.

---

<div class="post-metadata">

**Author:** ![juxeii](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/juxeii/32/7485_2.png) [@juxeii](https://community.traefik.io/u/juxeii)\
**Post date:** [April 30, 2025, 9:45am UTC](https://community.traefik.io/t/cannot-retrieve-the-acme-challenge/27350/5 "2025-04-30T09:45:20Z")

</div>

Ok, I should have mentioned that I moved my services to a new VPS. Could it be that all the certs which are still valid, have a problem with the new DNS entry?  
If thats the case, what is the best way to move the certs from one location to another? Just update the ACME file on the new VPS?

EDIT: so I just read that it is OK to have multiple IPs pointing to the same DNS name. But I guess the problem is that I have two different key entries in the ACME files. I will try to copy the entry from the old server into the new VPS.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [April 30, 2025, 11:41am UTC](https://community.traefik.io/t/cannot-retrieve-the-acme-challenge/27350/6 "2025-04-30T11:41:50Z")

</div>

Usually a DNS name points to one or multiple IPs, not the other way around.

---

<div class="post-metadata">

**Author:** ![NotARobot](https://avatars.discourse-cdn.com/v4/letter/n/f19dbf/32.png) [@NotARobot](https://community.traefik.io/u/NotARobot)\
**Post date:** [August 27, 2025, 2:36pm UTC](https://community.traefik.io/t/cannot-retrieve-the-acme-challenge/27350/7 "2025-08-27T14:36:45Z")

</div>

Hello

@juxeii I have the same issue did you manage to solve yours ?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [August 27, 2025, 6:32pm UTC](https://community.traefik.io/t/cannot-retrieve-the-acme-challenge/27350/8 "2025-08-27T18:32:26Z")

</div>

Please don’t hijack another thread. Create your own, share your full Traefik static and dynamic config, and Docker compose file(s) if used.

Enable and check Traefik debug log ([doc](https://doc.traefik.io/traefik/observability/logs/#level)), any "ERR" in logs? Enable and check Traefik access log in JSON format ([doc](https://doc.traefik.io/traefik/observability/access-logs/#format)), what’s the output during requests?