dnsChallenge for "www.*.example.org"

Traefik Traefik v2 (latest)
,
1

With the config below the issued certificate doesn't work for www.abc.example.org but it works for www.example.org and abc.example.org .

http:
  routers:
    web-router:
      rule: "Host(`example.org`) ||
       Host(`www.example.org`) ||
       HostRegexp(`{subdomain:[a-z-]+}.example.org`) ||
       HostRegexp(`www.{subdomain:[a-z-]+}.example.org`)"

      entryPoints:
        - web
      middlewares:
        - redirect
        - csrf
      service: django


    web-secure-router:
      rule: "Host(`example.org`) ||
       Host(`www.example.org`) ||
       HostRegexp(`{subdomain:[a-z-]+}.example.org`) ||
       HostRegexp(`www.{subdomain:[a-z-]+}.example.org`)"

      entryPoints:
        - web-secure
      middlewares:
        - csrf
      service: django
      tls:
        certResolver: letsencrypt
        domains:
          - main: "*.example.org"
            sans:
              - "example.org"

certificatesResolvers:
  letsencrypt:
    acme:
      email: "email@example.com"
      storage: /etc/traefik/acme/acme.json
      dnsChallenge:
        provider: route53
        delayBeforeCheck: 0

In the DNS I have A records for example.org and *.example.org .

Is it possible to get a certificate that works for www.*.example.org and *.example.org in the same time?

2

Hello @Karol

Based on my best knowledge the TLS certificates can be obtained only for the first level of your subdomain. I mean that you can obtain the certificate for .example.com but www..example is not correct.

According to the RFC2818

if more than one identity of a given type is present in the certificate (e.g., more than one dNSName name, a match in any one of the set is considered acceptable.) Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., .a.com matches foo.a.com but not bar.foo.a.com. f.com matches foo.com but not bar.com.

Thank you,

3

Yeah, thanks for the comment. I will just go with redirecting www to non-www instead of generating certs for 'www.*'