Letsencrypt wildcard certificate used by two routers

Since Traefik v2, I can't figure out how to configure two routers using the same wildcard letsencrypt certificate with DNS challenge.

Resolver part of static configuration

  email = "me@example.com"
  storage = "acme.json"
  caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
    provider= "linodev4"

Routers in dynamic configuration

      rule = "Host(`git.example.com`)"
      service = "git"
      entryPoints = ["websecure"]
        certResolver = "le-dns"
          main = "example.com"
          sans = ["*.example.com"]

      rule = "Host(`registry.example.com`)"
      service = "dockerregistry"
      entryPoints = ["dockerregistry"]
        certResolver = "le-dns"
          main = "example.com"
          sans = ["*.example.com"]

Since Traefik v2, tls configuration is made at the router level. Configuring just one works flawlessly. The problem arises when we try to configure two or more, as in the above example.

What are we doing wrong? We tried sans parameter including only the router's subdomain instead of the asterisk. Another thing we tried is replicating both domains like this ["registry.example.com", "git.example.com"] in both of them. None of these configs has ended up making the website work in HTTPS. We end up having bad certificate errors in browsers.

Most of the time, we find of logs similar as these:

level=debug msg="No ACME certificate generation required for domains [\"example.com\" \"registry.example.com\" \"git.example.com\"]." providerName=le-dns.acme
level=debug msg="http: TLS handshake error from xx.xx.xx.xx:40616: remote error: tls: unknown certificate authority"

Can somebody help us configuring two routers with the same wildcard certificate issuded by one DNS challenge?

Thank you very much!

Looks like this guy has similar questions...

not sure if you found a solution in the meanwhile but I figured this out by reading this article.

I created the traefik router with the tls domains part and every other service router only have the option tls=true.