How to force traefik to generate certificate for a domain?

[xd003]

I am intending to generate multiple wildcard certificates using cloudflare dnschallenge for multiple domains. For instance -

Certificate1 - example.com & *.example..com
Certificate2 - adguard.example.com & *.adguard.example.com

Pointing out the most relevant section from the docker compose

 - "--entrypoints.websecure.http.tls.domains[0].main=example.com"
 - "--entrypoints.websecure.http.tls.domains[0].sans=*.example.com"
 - "--entrypoints.websecure.http.tls.domains[1].main=adguard.example.com"
 - "--entrypoints.websecure.http.tls.domains[1].sans=*.adguard.example.com"

The first certificate is generated perfectly fine but the issue is that while generating the second certificate, it outputs the following in logs

Domain "adguard.example.com" is duplicated in the configuration or validated by the domain {example.com [*.example.com]}. It will be processed once

As a result of this, adguard.example.com is not processed in the second certificate and this cert only remains valid for *.adguard.example.com. Is there any way to force traefik to process this domain inspite of being covered by a earlier certificate ?

docker-compose - https://pastebin.com/raw/GGAAwXBj
Traefik version 3.0.0-beta3
Ubuntu 22.04

[bluepuma77]

It seems Traefik and le-go are "smart" and won’t create overlapping certs.

Do you need sans=*.example.com"? main=adguard.example.com" would be covering it.

[xd003]

After further testing, it doesn't seem possible to create certificates that overlap with each other. The only way out i found was to create a single domain sans with everything required

- "--entrypoints.websecure.http.tls.domains[0].main=example.com"
- "--entrypoints.websecure.http.tls.domains[0].sans=*.example.com,*.adguard.example.com"

[bluepuma77]

If you want this really bad, you can of course create your own LE certificates outside of Traefik, for example with certbot.

Certbot needs to know about the domains, you can use existing or additional labels, get data from Traefik API or directly from Docker socket.

Then you need to run certbot and create the certs, finally provide them to Traefik either as file for providers.file or as web-service for providers.http.

I built a proof-of-concept to create a LE solution for clustered Traefik.