Let's Encrypt Wildcard but Dashboard using domain specific ssl cert?

I'm trying to migrate from Nginx-Proxy-Manager over to Traefik due to it's excellent reputation and support for authentication middleware, but after going through 4 blog posts, multiple git's (suggesting 1.7 and 2.2 files) I cannot get my dashboard to use a Let's Encrypt wildcard SSL.

My traefik.toml looks like

    address = ":80"
      to = "websecure"
      scheme = "https"

    address = ":443"

      certResolver = "lets-encrypt"
        main = "example.com"
        sans = "*.example.com"
  dashboard = true

  email = "admin@example.com"
  storage = "acme.json"
    provider = "route53"

  filename = "traefik_dynamic.toml"

and traefik_dynamic.toml

  users = [

  rule = "Host(`monitor.lab.example.com`)"
  entrypoints = ["websecure"]
  middlewares = ["simpleAuth"]
  service = "api@internal"
    certResolver = "lets-encrypt"

Upon accessing it, I can see it using a cert for monitor.lab.example.com instead of *.lab.example.com and can confirm in the acme.json too that it's not generating a wildcard one.

I must be clearly missing something here.

I think Traefik just uses the Host to generate a certificate for the service.

Check the Traefik debug logs for what’s happening, it could still create a wildcard cert.

1 Like

I was under the impression we could define it for all hosts in one shot, but defining it per host like below does resolve it and indeed creates only one cert for multiple hosts. Thanks.