How to force Traefik to combine domains in one single certificate

Traefik Traefik v2
1

I am currently managing about a 100 servers, each having multiple websites hosted as containers behind Traefik.

I noticed that when we add a second domain to a website for which Traefik already has a certificate, Traefik will keep the certificate that it already had and generate a new one for the newly added domain, resulting in two certificates for that website.

I would however like for these domains to always be combined in a single certificate, and I would like for Traefik in this situation to generate a single new certificate containing both domain names, and to discard the old certificate which does not contain the new domain name.

Is there any way to do this?

2

Hello @R-VdP

Thank you for using Traefik.

Have you tried to use SANS feature according to that example?

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: blogtls
spec:
  entryPoints:
    - websecure
  routes:
  - match: Host(`example.com`) && Path(`/blog`)
    kind: Rule
    services:
    - name: blog
      port: 8080
  tls:
    certResolver: myresolver
    domains:
    - main: example.org
      sans:
      - '*.example.org'

https://doc.traefik.io/traefik/https/acme/

3

Thank you for your response, @jakubhajek !

I am using docker-compose, the labels on my containers look as follows:

labels:
  - "traefik.enable=true"
  - "traefik.http.routers.my_router.rule=Host(`example.org`)"
  - "traefik.http.routers.my_router.tls.domains[0].main=example.org"
  - "traefik.http.routers.my_router.tls.domains[0].sans=subdomain.example.org"
  - "traefik.http.routers.my_router.tls.certresolver=letsencrypt_dns"

I do not have any particular configuration regarding TLS or ACME, besides the definition of the letsencrypt_dns resolver:

certificatesresolvers:
  letsencrypt_dns:
    acme:
      dnsChallenge:
        provider: XXX
        resolvers:
          - "9.9.9.9:53"
          - "8.8.8.8:53"
          - "1.1.1.1:53"
      email: foo@example.org
      keyType: EC256
      storage: "/letsencrypt/acme.json"