Cloudflare DNS certificate renewal issue

Traefik Traefik v2
1

I just migrated everything over to v2 on my docker instance, and am getting a weird error in my logs with regards to renewing my certificates. (domains changed to protect the innocent)

time="2019-09-26T08:20:34-04:00" level=error msg="Error renewing certificate from LE: {<domain> []}, acme: Error -> One or more domains had a problem:\n[<domain>] [<domain>] acme: error presenting token: cloudflare: failed to find zone <domain>.: ListZonesContext command failed: error from makeRequest: HTTP status 400: content \"{\\\"success\\\":false,\\\"errors\\\":[{\\\"code\\\":6003,\\\"message\\\":\\\"Invalid request headers\\\",\\\"error_chain\\\":[{\\\"code\\\":6102,\\\"message\\\":\\\"Invalid format for X-Auth-Email header\\\"}]}],\\\"messages\\\":[],\\\"result\\\":null}\"\n" providerName=default.acme

I used the migration tool to update my acme.json file, so things should be ok there. I manually updated my static configuration, as the migration tool came back with a lot of manual needs. Everything was working just fine in v1 land. Docker is passing the CF_API_EMAIL correctly.

Anyone else having this issue?

2

hello,

the acme.json format has changed between v1 and v2, you have to use the migration tool: https://github.com/containous/traefik-migration-tool

3

I did use the migration tool, and acme.json is in the v2 format. Still broken.

4

I found my issue. In my docker-compose file, I have the following:

    environment:
      - CF_API_EMAIL=${CLOUDFLARE_EMAIL}
      - CF_API_KEY=${CLOUDFLARE_API_KEY}

In my .env file, I have CLOUDFLARE_EMAIL as "name@domain.com". I tried name\@domain.com to see if escaping the "@" worked, and it turns out I needed to not escape it nor use double-quotes which worked previously.

`

1 Like