How to Force-Trigger Let’s Encrypt Certificate generation without restarting Traefik

Traefik Traefik v2
1

I use DNSChallange with "httpreq" as provider (HTTP request :: Let’s Encrypt client and ACME library written in Go.) to generate Let's Encrypt certificaes.
I also use dynamic configs to add new routers. This works very well.

But this week one of our DNS server could not be reached by the Traefik instance. TheTraefk log said:

error: one or more domains had a problem: [xx] time limit exceeded: last error: NS ns3.xxx. did not return the expected TXT record

Now, the Traefik instance can reach the DNS server but how do I tell Traefik to retrigger the Let's Encryped certificate process without restarting the Traefik instance?

Adding new rourters works. Removing and readding the same router after a failed Let's Encryped certificate process does not work.

How can I retrigger the Let's Encryped certificate process without restarting the Traefik proxy process?

2

@spezifanta this is a known limitation and I believe it is more a deliberate decision at this point than a bug in itself, you see if Traefik would allow it to retry you would get rate limited by LE at some point until the root cause is fixed and then even after the fix you would have to wait for the rate limit expiration.

This way its up for the user to understand what is wrong, fix it and then take action to get the certificate request sent again (a restart currently).

Of course this is not optimal in all use cases and we have an open issue to discuss the topic here so you can track or participate in the discussion and proposals to improve the UX.

3

Thanks for your response.
Ok, I understand. This makes sense. However, I was hoping that there was a manual step to invoke the certificate request process for a route.

4

My experience is that restarting traefik made it retry the cert generation. I'm using it with docker but I'm pretty sure any service restart would result in the same thing since Traefik will check the acme.json file, compare the list of domains with its configuration and then attempt to generate certs for any missing ones.