# Disable Lets Encrypt for some domain name

**URL:** <https://community.traefik.io/t/disable-lets-encrypt-for-some-domain-name/26899>\
**Category:** Traefik v3 (latest)\
**Tags:** letsencrypt-acme\
**Created:** [March 17, 2025, 11:25am UTC](https://community.traefik.io/t/disable-lets-encrypt-for-some-domain-name/26899 "2025-03-17T11:25:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![AntonR-beep](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/antonr-beep/32/10142_2.png) [@AntonR-beep](https://community.traefik.io/u/AntonR-beep)\
**Post date:** [March 17, 2025, 11:25am UTC](https://community.traefik.io/t/disable-lets-encrypt-for-some-domain-name/26899/1 "2025-03-17T11:25:47Z")

</div>

Hi everyone! First, thanks to the team for the great product! Second: could someone help please, Im trying to handle the case, where some subdomain should get certificate from lets encrypt, and some should just passthrough the traffic for 80 port (as I understand) for internal win-acme bot. So, for example, I want to handle certificate for [subdomain.contoso.com](http://subdomain.contoso.com) for rdp server on windows machine itself, so I'm setting up like:

static config:

```auto
entryPoints:
  web:
    address: ":80" # HTTP entry point
  websecure:
    address: ":443" # HTTPS entry point
  rdp:
    address: ":3389" # RDP

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false 
  file:
    filename: "/etc/traefik/traefik_dynamic.yml" 
    watch: true

certificatesResolvers:
  letsencrypt:
    acme:
      email: ######################
      storage: "/acme/acme.json"
      httpChallenge:
        entryPoint: web

log:
  level: DEBUG

```

dynamic config:

```auto
tcp:
  routers:
    rdp-router:
      rule: "HostSNI(`subdomain.contoso.com`)"
      entryPoints:
        - rdp
      tls:
        passthrough: true
      service: rdp-service

  services:
    rdp-service:
      loadBalancer:
        servers:
          - address: "someip:3389"

http:
  routers:
    acme-challenge-router-for-wacs:
      rule: "Host(`subdomain.contoso.com`)"
      entryPoints:
        - web
      service: acme-challenge-service-for-wacs

  services:
    acme-challenge-service-for-wacs:
      loadBalancer:
        servers:
          - url: "http://someip:80" 

```

But it looks like traefik still trying to get certificate for [subdomain.contoso.com](http://subdomain.contoso.com). How to disable it and passthrough correctly 80 port also? Alos, when I played around with settings, when I run win-acme, I got in the log of traefik:

```auto
Unable to split host and port. Fallback to request host. error="address subdomain.contoso.com: missing port in address" providerName=acme

```

And it looks like traefik intercepting acme request also? So I confused and stuck, please help. Thanks in advance.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [March 17, 2025, 12:56pm UTC](https://community.traefik.io/t/disable-lets-encrypt-for-some-domain-name/26899/2 "2025-03-17T12:56:26Z")

</div>

You can not use `HostSNI(`domain`)`, if Traefik has no access to the cert, which according to you will be created by the target service. Traefik needs access to the cert to decrypt the HostSNI.

If you only have a single target service on the port, you can use `HostSNI(`*`)`. But don't use any TLS options, as that might activate Traefik TLS and result in a custom cert. `passthrough` is the default behavior for a TCP router without TLS.

Note that RDP usually also uses UDP, which makes matters even more complicated.

---

<div class="post-metadata">

**Author:** ![AntonR-beep](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/antonr-beep/32/10142_2.png) [@AntonR-beep](https://community.traefik.io/u/AntonR-beep)\
**Post date:** [March 17, 2025, 1:03pm UTC](https://community.traefik.io/t/disable-lets-encrypt-for-some-domain-name/26899/3 "2025-03-17T13:03:45Z")

</div>

Thanks for answering! As I understand Traefik also support UDP. If I want to handle couple RDP servers with self-managed acme, and forward traffic based on hostname, it's not possible then, cause traefik doesnt have access to the certificate, correct?...

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [March 17, 2025, 1:11pm UTC](https://community.traefik.io/t/disable-lets-encrypt-for-some-domain-name/26899/4 "2025-03-17T13:11:14Z")

</div>

You can only use a single service on a pure TCP port, without HostSNI.

If you want to use multiple, you need to provide the certs to Traefik or use different ports.

Note that UDP is a completely different beast than TCP, as it is not session oriented. When Traefik forwards a UDP packet, the sender IP will change. So unless the original IP is placed in the UDP packet content, or is communicated via TCP data, a return packet can not be sent. Also the server need to tell the RDP client to use a different UDP target IP, the IP of the Traefik server.

---

<div class="post-metadata">

**Author:** ![AntonR-beep](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/antonr-beep/32/10142_2.png) [@AntonR-beep](https://community.traefik.io/u/AntonR-beep)\
**Post date:** [March 17, 2025, 3:23pm UTC](https://community.traefik.io/t/disable-lets-encrypt-for-some-domain-name/26899/5 "2025-03-17T15:23:01Z")

</div>

Got it. So it looks like bad idea 😃 Thanks for helping.