# How to get two main domains and then multiple sub domain with sans via LE?

**URL:** <https://community.traefik.io/t/how-to-get-two-main-domains-and-then-multiple-sub-domain-with-sans-via-le/6533>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme, docker\
**Created:** [June 15, 2020, 4:23pm UTC](https://community.traefik.io/t/how-to-get-two-main-domains-and-then-multiple-sub-domain-with-sans-via-le/6533 "2020-06-15T16:23:39Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![mannp](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@mannp](https://community.traefik.io/u/mannp)\
**Post date:** [June 15, 2020, 4:23pm UTC](https://community.traefik.io/t/how-to-get-two-main-domains-and-then-multiple-sub-domain-with-sans-via-le/6533/1 "2020-06-15T16:23:39Z")

</div>

Hi there

After having hit LE limits twice already I am slightly desperate to understand what I am doing wrong...if anyone would help 🙂

I have two web facing domains via traefik 2 and each of those domains has 6 or 9 sub domains.

I am trying to request one or two certificates (for domain1 and domain2 or one for both) from LE, but I am obviously not defining it correctly to the limits.

The question is do I have to list the main and 8 subdomains against each router definition as in 1) and 2) below? Thanks in advance....

I am using http challenge for LE.

I would like get two certs;

> ```
> 1) domain1:
> - main: "domain1.com"
> sans:
> - "sub1.domain1.com"
> - "sub2.domain1.com"
> - "sub3.domain1.com"
> - "sub4.domain1.com"
> .......
> 
> ```

and

> ```
> 2) domain2:
> - main: "tdomain2.com"
> sans:
> - "sub1.domain2.com"
> - "sub2.domain2.com"
> - "sub3.domain2.com"
> - "sub4.domain2.com"
> .......
> 
> ```

The docs refer to a definition in each router, so I have tried in my router definition per application;

This worked but I hit LE limits;

> ```
> tls:
> certResolver: letsencrypt
> domains:
> - main: "traefik.domain1.com"
> 
> ```

then

> ```
> tls:
> certResolver: letsencrypt
> domains:
> - main: "sub1.domain2.com"
> 
> ```

then this, which didn't seem to work, error from the cert server....

> ```
> - main: "domain1.com"
> sans:
> - "*.domain1.com"
> 
> ```

```auto

```

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [June 16, 2020, 1:58am UTC](https://community.traefik.io/t/how-to-get-two-main-domains-and-then-multiple-sub-domain-with-sans-via-le/6533/2 "2020-06-16T01:58:32Z")

</div>

Try switching to the LE [staging server](https://docs.traefik.io/https/acme/#caserver) while you work this out, as it has higher rate limits.

The traefik log should show why the acme challenge is not completing and/or show which limit you may be hitting.

You can also use [https://letsdebug.net/](https://letsdebug.net/) to help troubleshoot.

---

<div class="post-metadata">

**Author:** ![ldez](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ldez/32/5_2.png) [@ldez](https://community.traefik.io/u/ldez)\
**Post date:** [June 16, 2020, 8:01am UTC](https://community.traefik.io/t/how-to-get-two-main-domains-and-then-multiple-sub-domain-with-sans-via-le/6533/3 "2020-06-16T08:01:02Z")

</div>

Hello,

to get wildcard certificates you have to use the DNS challenge:

- [https://docs.traefik.io/v2.2/https/acme/#wildcard-domains](https://docs.traefik.io/v2.2/https/acme/#wildcard-domains)

---

<div class="post-metadata">

**Author:** ![mannp](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@mannp](https://community.traefik.io/u/mannp)\
**Post date:** [June 16, 2020, 9:15am UTC](https://community.traefik.io/t/how-to-get-two-main-domains-and-then-multiple-sub-domain-with-sans-via-le/6533/4 "2020-06-16T09:15:15Z")

</div>

Thanks @cakiwi for taking the time to reply 🙂

I have been using the staging server, where all of the certificate requests succeeded and all was well.

My issue is not with LE, it is with how traefik 2 requests the certs depending on their definition in the configs. That seems missing from the docs, as its critical to know if you will hit the limits.

What it didn't show me is that a separate cert was being requested per micro service router I had defined, which I'd understood from the 2.2 manual to be the new way of defining the main and sans certs.

Logically to me the 1.7 way of defining main and sans was more logical but I could understand defining per router would be more flexible?

What I couldn't find was any example of splitting those out?

So having a main [domain1.com](http://domain1.com) on one micro service router and then defining all of the others as sans perhaps? Who know.

I would have thought that all the sans sub domains would be grouped and traefik 2 would request 1 cert from LE, but it doesn't it requests 11, 1 main and 10 sub domains.

I have since main progress by duckduckdoing but not after a number of days trying to figure out the docs (which are otherwise great though).

---

<div class="post-metadata">

**Author:** ![mannp](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@mannp](https://community.traefik.io/u/mannp)\
**Post date:** [June 16, 2020, 9:19am UTC](https://community.traefik.io/t/how-to-get-two-main-domains-and-then-multiple-sub-domain-with-sans-via-le/6533/5 "2020-06-16T09:19:14Z")

</div>

Hi @ldez thanks for taking the time to reply.

Thanks for the link, except I know what wildcard certs are just not how to define them and where within the traefik 2 config?

Where does it show how to do that in the docs, as I couldn't find it 🙂

I have now wildcards sorted after a late evening last night and a good bit of duckduckdoing, but I am still unclear how to define a non wildcard http set of main and sub domains in traefik2 :-/ ?

---

<div class="post-metadata">

**Author:** ![mannp](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@mannp](https://community.traefik.io/u/mannp)\
**Post date:** [June 16, 2020, 11:01am UTC](https://community.traefik.io/t/how-to-get-two-main-domains-and-then-multiple-sub-domain-with-sans-via-le/6533/6 "2020-06-16T11:01:43Z")

</div>

I ended up adding the main and sans for each domain in the domain to www.domain redirect, while removing it from all the other routers .... I now have a cert store with two certs, with domain1+subdomains and domain2+subdomains working via http.

I can also successfully request wildcard certs via dns 🙂

I don't know if this is an approved method, but its the only one I have found to work.

---

<div class="post-metadata">

**Author:** ![l0rdraiden](https://avatars.discourse-cdn.com/v4/letter/l/b5a626/32.png) [@l0rdraiden](https://community.traefik.io/u/l0rdraiden)\
**Post date:** [May 25, 2023, 9:03pm UTC](https://community.traefik.io/t/how-to-get-two-main-domains-and-then-multiple-sub-domain-with-sans-via-le/6533/7 "2023-05-25T21:03:04Z")

</div>

Could you explain your solution better o post the configuration please?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [May 25, 2023, 9:17pm UTC](https://community.traefik.io/t/how-to-get-two-main-domains-and-then-multiple-sub-domain-with-sans-via-le/6533/8 "2023-05-25T21:17:20Z")

</div>

Take a [simple Traefik example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt), change LE validation to `dnsChallenge` ([example](https://doc.traefik.io/traefik/user-guides/docker-compose/acme-dns/), [doc](https://doc.traefik.io/traefik/https/acme/#dnschallenge)) and add the main/sans to the router ([doc](https://doc.traefik.io/traefik/https/acme/#configuration-examples)) to get a wildcard cert:

```auto
## Dynamic configuration
labels:
  - traefik.http.routers.blog.rule=Host(`example.com`) && Path(`/blog`)
  - traefik.http.routers.blog.tls=true
  - traefik.http.routers.blog.tls.certresolver=myresolver
  - traefik.http.routers.blog.tls.domains[0].main=example.org
  - traefik.http.routers.blog.tls.domains[0].sans=*.example.org

```

Traefik will also create a cert for multiple domains with `tlsChallenge` if you just specify all the domains using `Host()`. Make sure all domains point to your server IP.

```auto
.rule=Host(`example.com`) || Host(`sub.example.com`)

```

Also make sure to save the `acme.json` in a mounted folder or in a volume to not create a new cert on every restart, otherwise you might hit the limits.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [August 14, 2023, 7:57pm UTC](https://community.traefik.io/t/how-to-get-two-main-domains-and-then-multiple-sub-domain-with-sans-via-le/6533/9 "2023-08-14T19:57:40Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.