# Fails to use wildcard cert

**URL:** <https://community.traefik.io/t/fails-to-use-wildcard-cert/9986>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme\
**Created:** [March 10, 2021, 2:11am UTC](https://community.traefik.io/t/fails-to-use-wildcard-cert/9986 "2021-03-10T02:11:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![smrtrock](https://avatars.discourse-cdn.com/v4/letter/s/8edcca/32.png) [@smrtrock](https://community.traefik.io/u/smrtrock)\
**Post date:** [March 10, 2021, 2:11am UTC](https://community.traefik.io/t/fails-to-use-wildcard-cert/9986/1 "2021-03-10T02:11:35Z")

</div>

Managed to get a wildcard certificate created and when I go to switch on tls I get cert errors from the browser

```auto
# Web Organizer - see all services at a glance
  heimdall:
    image: linuxserver/heimdall:latest
    hostname: heimdall
    container_name: heimdall
    restart: always
    environment: 
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    networks: 
      - t2_proxy 
    volumes:  
      - ${docker_dir}/heimdall:/config
    labels: 
      - traefik.enable=true
      - traefik.docker.network=t2_proxy
      # Http routers
      - traefik.http.routers.heimdall.entrypoints=web,websecure
      - traefik.http.routers.heimdall.rule=Host(`home.${DOMAINNAME}`)
      - traefik.http.routers.heimdall.tls=true
      # Service
      - traefik.http.routers.heimdall.service=heimdall
      - traefik.http.services.heimdall.loadbalancer.server.port=80

```

I get the following error

# Your connection isn't private

Attackers might be trying to steal your information from **[home.example.com](http://home.example.com)** (for example, passwords, messages, or credit cards).

NET::ERR\_CERT\_AUTHORITY\_INVALID

when I look at the cert I see Traefik default certificate

My Acme.json file looks like this

```json
{
  "cloudflare-resolver": {
    "Account": {
      "Email": "example@outlook.com",
      "Registration": {
        "body": {
          "status": "valid",
          "contact": [
            "mailto:example@outlook.com"
          ]
        },
        "uri": "https://acme-v02.api.letsencrypt.org/acme/acct/ ********"
      },
      "PrivateKey": "randomgeneratedvalue",
      "KeyType": "4096"
    },
    "Certificates": [
      {
        "domain": {
          "main": "example.com",
          "sans": [
            "*.example.com"
          ]
        },
        "certificate": "randomlygeneratedvalue",
        "key": "randmonlygeneratedvalue",
        "Store": "default"
      }
    ]
  }
}

```

---

<div class="post-metadata">

**Author:** ![burke](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/burke/32/3630_2.png) [@burke](https://community.traefik.io/u/burke)\
**Post date:** [April 6, 2021, 3:46am UTC](https://community.traefik.io/t/fails-to-use-wildcard-cert/9986/2 "2021-04-06T03:46:40Z")

</div>

> [@smrtrock](#):
>
> ` - traefik.http.routers.heimdall.tls=true`

After this line in your heimdall labels, I think you need to specify WHICH resolver to use (and, I think domains).. based on your acme json, I would guess your next line after the tls=true should be:

- traefik.http.routers.heimdall.tls.certResolver=cloudflare-resolver
- traefik.http.routers.heimdall.tls.domains[0].main=[example.com](http://example.com)
- traefik.http.routers.heimdall.tls.domains[0].sans=\*.example.com