Multiple traefik instances using same letsencrypt domain fails to create certs

Traefik Traefik v2
,
1

I am running multiple traefik instances, they all use lets encrypt and cloudflare DNS, and they all create certificates for the same domain.

The first instance works fine, subsequent instances fail with a variety of errors, most notable the record already exists.

time="2020-07-03T11:43:34-07:00" level=error msg="Unable to obtain ACME certificate for domains \"insanegenius.net,*.insanegenius.net\" : unable to generate a certificate for the domains [insanegenius.net *.insanegenius.net]: error: one or more domains had a problem:\n[*.insanegenius.net] [*.insanegenius.net] acme: error presenting token: cloudflare: failed to create TXT record: error from makeRequest: HTTP status 400: content \"{\\\"result\\\":null,\\\"success\\\":false,\\\"errors\\\":[{\\\"code\\\":81057,\\\"message\\\":\\\"The record already exists.\\\"}],\\\"messages\\\":[]}\"\n[insanegenius.net] [insanegenius.net] acme: error presenting token: cloudflare: failed to create TXT record: error from makeRequest: HTTP status 400: content \"{\\\"result\\\":null,\\\"success\\\":false,\\\"errors\\\":[{\\\"code\\\":81057,\\\"message\\\":\\\"The record already exists.\\\"}],\\\"messages\\\":[]}\"\n" providerName=dns-cloudflare.acme,

How can I configure letsencrypt such that multiple traefik instances using multiple acme.json files will successfully create SSL certs for the same domain?

2

You can't with V2. You're looking at TraefikEE for this.

V1 you could do this backed by etcd but I've heard it was 'problematic'.

3

Thx, I assume it is due to the acme.json to lets encrypt account to dns unique cname records to with each acme.json carrying a private key?

On the same server I can easily share the acme.json file, on different servers with a bit of trouble, would this work? (assuming there may still be timing problems when multiple instances try to refresh the acme.json at the same time)

Or, could I copy the acme.json section containing the account and private key and share that?

4

Its not recommended.
its says here https://docs.traefik.io/https/acme/#storage

For concurrency reasons, this file cannot be shared across multiple instances of Traefik.

We would also like to have this feature in CE but its clearly an EE Feature atm.

5

Any luck on figuring out a solution to your dilemma, OP?

6

I reverted to using static commercial SSL wildcard certs.
Not really a good or free solution, but it works.