# Invalid certificate generated by traefik

**URL:** <https://community.traefik.io/t/invalid-certificate-generated-by-traefik/7786>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme, docker\
**Created:** [September 22, 2020, 6:14pm UTC](https://community.traefik.io/t/invalid-certificate-generated-by-traefik/7786 "2020-09-22T18:14:27Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ShrewdSpirit](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/shrewdspirit/32/2557_2.png) [@ShrewdSpirit](https://community.traefik.io/u/ShrewdSpirit)\
**Post date:** [September 22, 2020, 6:14pm UTC](https://community.traefik.io/t/invalid-certificate-generated-by-traefik/7786/1 "2020-09-22T18:14:27Z")

</div>

Hello. I'm using this static config but I always get this error when I connect to routers:  
`certificate is valid for 6accb836c84cae6698d99a36fe50f9c8.e1c76ae8150c0d3b43497acb995bf9e1.traefik.default, not db.ssvg.dev`

```yaml
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
      # permanent: true
    transport:
      respondingTimeouts:
        idleTimeout: 10s
  websecure:
    address: ":443"
    transport:
      respondingTimeouts:
        idleTimeout: 10s

certificatesResolvers:
  leresolver:
    acme:
      caServer: https://acme-v02.api.letsencrypt.org/directory
      email: info@ssvg.dev
      storage: /etc/letsencrypt/acme.json
      httpChallenge:
        entryPoint: web
      dnsChallenge:
        resolvers:
          - "192.168.43.51"

```

note that I'm using dnsmasq as local dns server.

**also** I wonder why traefik tries to issue certificates from lets encrypt many times that I reach the rate limit and get this error `level=error msg="Unable to obtain ACME certificate for domains \"db.ssvg.dev\": unable to generate a certificate for the domains [db.ssvg.dev]: acme: error: 429 :: POST :: https://acme-v02.api.letsencrypt.org/acme/new-order :: urn:ietf:params:acme:error:rateLimited :: Error creating new order :: too many failed authorizations recently: see https://letsencrypt.org/docs/rate-limits/, url: " providerName=leresolver.acme routerName=adminer-router@docker rule="Host(`db.ssvg.dev`)"` ?

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [September 22, 2020, 6:34pm UTC](https://community.traefik.io/t/invalid-certificate-generated-by-traefik/7786/2 "2020-09-22T18:34:38Z")

</div>

Try using another resolver using the letsencrypt staging until you get this working. Much higher limits.

You need to make use that the dns points to this server. Internet resolving DNS that is.  
Also port 80 needs to be open and accessible on the internet.

You can use [https://letsdebug.net/](https://letsdebug.net/) to help troubleshoot.

---

<div class="post-metadata">

**Author:** ![ShrewdSpirit](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/shrewdspirit/32/2557_2.png) [@ShrewdSpirit](https://community.traefik.io/u/ShrewdSpirit)\
**Post date:** [September 22, 2020, 7:17pm UTC](https://community.traefik.io/t/invalid-certificate-generated-by-traefik/7786/3 "2020-09-22T19:17:46Z")

</div>

I get the same result `certificate is valid for 6accb836c84cae6698d99a36fe50f9c8.e1c76ae8150c0d3b43497acb995bf9e1.traefik.default, not db.ssvg.dev` even with staging. also I can't use letsdebug since my dns is a local server. everything is being done locally at the moment. I'm not sure if that's the problem

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [September 22, 2020, 7:24pm UTC](https://community.traefik.io/t/invalid-certificate-generated-by-traefik/7786/4 "2020-09-22T19:24:41Z")

</div>

> [@ShrewdSpirit](#):
>
> also I can't use letsdebug since my dns is a local server. everything is being done locally at the moment. I'm not sure if that's the problem

Yes, yes it it, that is why I said:

> [@cakiwi](#):
>
> You need to make use that the dns points to this server. Internet resolving DNS that is.  
> Also port 80 needs to be open and accessible on the internet.

If you'd tried letsdebug you would have got a No A or AAAA records error.

---

<div class="post-metadata">

**Author:** ![ShrewdSpirit](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/shrewdspirit/32/2557_2.png) [@ShrewdSpirit](https://community.traefik.io/u/ShrewdSpirit)\
**Post date:** [September 22, 2020, 7:57pm UTC](https://community.traefik.io/t/invalid-certificate-generated-by-traefik/7786/5 "2020-09-22T19:57:27Z")

</div>

So I need to have a static IP right?  
Because right now I'm using dynamic IP and instead of using a private IP, decided to use dnsmasq with a basic config locally

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [September 22, 2020, 8:10pm UTC](https://community.traefik.io/t/invalid-certificate-generated-by-traefik/7786/6 "2020-09-22T20:10:06Z")

</div>

No. As long as it resolves when it tries to get a certificate from letsEncrypt.

My home setup is dynamic ip. My domain points a CNAME to a record from www.nsupdate.info

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [September 25, 2020, 8:10pm UTC](https://community.traefik.io/t/invalid-certificate-generated-by-traefik/7786/7 "2020-09-25T20:10:07Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.