Problem setting up traefik for two subdomains

Traefik Traefik v2
,
1

I am setting up arangodb service and want to access it via https on a subdomain (and on port 8529 on localhost) and have traefik dashboard on another subdomain.
I want to obtain a valid SSL certificate for both subdomains. traefik.mydomain.app works correctly but arangodb.mydomain.app gets an unsafe warning. Other than that services are running correctly.
The below is my docker-compose.yaml

PS. my domain is not really mydomain.app but it is .app and DNS records are set correctly.

'''

version: '3.8'

services:
  traefik:
    image: traefik:v2.11
    container_name: traefik
    command:
      - "--api.dashboard=true" 
      - "--api.insecure=false" 
      - "--providers.docker=true"
      - "--entrypoints.web.address=:80" 
      - "--entrypoints.websecure.address=:443" 
      - "--certificatesresolvers.myresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.myresolver.acme.email=${TRAEFIK_EMAIL}"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro" 
      - "./letsencrypt:/letsencrypt" 
      - "./shared:/shared" 
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN}`)"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.tls=true"
      - "traefik.http.routers.traefik.tls.certresolver=myresolver"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.middlewares.traefik-auth.basicauth.usersfile=/shared/.htpasswd"
      - "traefik.http.routers.traefik.middlewares=traefik-auth"
      - "traefik.http.routers.httpchallenge.rule=Host(`${ARANGO_DOMAIN}`)"
      - "traefik.http.routers.httpchallenge.entrypoints=web"
      - "traefik.http.routers.httpchallenge.tls.certresolver=myresolver"
    restart: always

  arangodb:
    image: arangodb:latest
    container_name: arangodb
    ports:
      - "127.0.0.1:8529:8529" 
    environment:
      - ARANGO_ROOT_PASSWORD=${ARANGO_ROOT_PASSWORD}
    volumes:
      - "arangodb3.12:/var/lib/arangodb3"
      - "arangodb3.12-apps:/var/lib/arangodb3-apps"
      - "arangodb3.12-backup:/backup"    
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.arangodb.rule=Host(`${ARANGO_DOMAIN}`)"
      - "traefik.http.routers.arangodb.entrypoints=websecure"
      - "traefik.http.routers.arangodb.tls=true"
      - "traefik.http.routers.arangodb.tls.certresolver=myresolver"
      - "traefik.http.services.arangodb.loadbalancer.server.port=8529"
    restart: always

networks:
  web:
    external: false
2

Try tlsChallenge, check simple Traefik example.