OVH wildcard certificate renewal problem

Hello,

I have a domain name (.fr) purchased from OVH. I use docker with traefik, and for simplicity's sake I wanted to set up wildcard certificates.
I've tried to set up a dns challenge but it doesn't seem to work properly. In fact, every 3 months I have to go through a lot of trouble to get my certificates working again. I can't figure out why my certificates are renewed after X number of operations.

My domain is: florian-garcia.fr

Here is an extract from my docker-compose configuration

environment:
	- "OVH_ENDPOINT=ovh-eu"
	- "OVH_APPLICATION_KEY=xxx"
	- "OVH_APPLICATION_SECRET=xxx"
	- "OVH_CONSUMER_KEY=xxx"
	- "TZ=Europe/Paris"

- --certificatesResolvers.letsencrypt.acme.email=mypersonalmail@xxx.fr
- --certificatesResolvers.letsencrypt.acme.storage=acme/acme.json
- --certificatesResolvers.letsencrypt.acme.dnsChallenge=true
- --certificatesResolvers.letsencrypt.acme.dnsChallenge.provider=ovh

Here are some error logs I can find traefik logs

time="2023-10-15T04:32:34+02:00" level=error msg="Error renewing certificate from LE: {mysubdomain.florian-garcia.fr []}" ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=letsencrypt.acme error="error: one or more domains had a problem:\n[mysubdomain.florian-garcia.fr] [mysubdomain.florian-garcia.fr] acme: error presenting token: ovh: no subdomain because the domain and the zone are identical: florian-garcia.fr.\n"

And here's my dns configuration on the OVH side.

I think I'm missing something (I'm a beginner in traefik / let's encrypt configuration), if you have a clue I'd love to hear from you. Thanks in advance!

image

Maybe share your full Traefik static and dynamic config. Not a single domain defined in what you showed.

I finally solved my issue; that was because of my DNS records. Traefik / Let's encrypt doesn't seems to be able to manage CNAME record for (wildcard) certificate. I replaced it by an A / AAAA record and it's working now

When using CNAME, you can set a special flag for Traefik TLS, check the docs.