Fails to use wildcard cert

Traefik Traefik v2 (latest)
1

Managed to get a wildcard certificate created and when I go to switch on tls I get cert errors from the browser

# Web Organizer - see all services at a glance
  heimdall:
    image: linuxserver/heimdall:latest
    hostname: heimdall
    container_name: heimdall
    restart: always
    environment: 
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    networks: 
      - t2_proxy 
    volumes:  
      - ${docker_dir}/heimdall:/config
    labels: 
      - traefik.enable=true
      - traefik.docker.network=t2_proxy
      # Http routers
      - traefik.http.routers.heimdall.entrypoints=web,websecure
      - traefik.http.routers.heimdall.rule=Host(`home.${DOMAINNAME}`)
      - traefik.http.routers.heimdall.tls=true
      # Service
      - traefik.http.routers.heimdall.service=heimdall
      - traefik.http.services.heimdall.loadbalancer.server.port=80

I get the following error

Your connection isn't private

Attackers might be trying to steal your information from home.example.com (for example, passwords, messages, or credit cards).

NET::ERR_CERT_AUTHORITY_INVALID

when I look at the cert I see Traefik default certificate

My Acme.json file looks like this

{
  "cloudflare-resolver": {
    "Account": {
      "Email": "example@outlook.com",
      "Registration": {
        "body": {
          "status": "valid",
          "contact": [
            "mailto:example@outlook.com"
          ]
        },
        "uri": "https://acme-v02.api.letsencrypt.org/acme/acct/********"
      },
      "PrivateKey": "randomgeneratedvalue",
      "KeyType": "4096"
    },
    "Certificates": [
      {
        "domain": {
          "main": "example.com",
          "sans": [
            "*.example.com"
          ]
        },
        "certificate": "randomlygeneratedvalue",
        "key": "randmonlygeneratedvalue",
        "Store": "default"
      }
    ]
  }
}
2

After this line in your heimdall labels, I think you need to specify WHICH resolver to use (and, I think domains).. based on your acme json, I would guess your next line after the tls=true should be:

  • traefik.http.routers.heimdall.tls.certResolver=cloudflare-resolver
  • traefik.http.routers.heimdall.tls.domains[0].main=example.com
  • traefik.http.routers.heimdall.tls.domains[0].sans=*.example.com