# problem with obtaining certs

**URL:** <https://community.traefik.io/t/problem-with-obtaining-certs/29444>\
**Category:** Traefik v3 (latest)\
**Tags:** docker\
**Created:** [December 13, 2025, 7:12am UTC](https://community.traefik.io/t/problem-with-obtaining-certs/29444 "2025-12-13T07:12:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrnoname](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/mrnoname/32/6893_2.png) [@mrnoname](https://community.traefik.io/u/mrnoname)\
**Post date:** [December 13, 2025, 7:12am UTC](https://community.traefik.io/t/problem-with-obtaining-certs/29444/1 "2025-12-13T07:12:32Z")

</div>

Hi,

I’m getting the following error when I try and use traefik with cloudflare as my dns,

I have the right api key in my compose file,

if someone can help it would be appreciated?

Note: even though I’m getting this error I’m still getting google trust certs from cloudflare but I wanna use let’s encrypt with traefik anyway here’s my error:

> ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [traefik.example.com]: error: one or more domains had a problem:\n[traefik.example.com] [traefik.example.com] acme: error presenting token: cloudflare: could not find zone for domain "[traefik.example.com](http://traefik.example.com)": [fqdn=\_acme-challenge.traefik.example.com.] could not find the start of authority for '\_acme-challenge.traefik.example.com.': DNS call error: read udp 172.21.0.3:39875-\>1.1.1.1:53: i/o timeout [ns=1.1.1.1:53, question='com. IN SOA']\nDNS call error: read udp 172.21.0.3:48481-\>1.0.0.1:53: i/o timeout [ns=1.0.0.1:53, question='com. IN SOA']\n" ACME CA=[https://acme-staging-v02.api.letsencrypt.org/directory](https://acme-staging-v02.api.letsencrypt.org/directory) acmeCA=[https://acme-staging-v02.api.letsencrypt.org/directory](https://acme-staging-v02.api.letsencrypt.org/directory) domains=["[traefik.example.com](http://traefik.example.com)"] providerName=cloudflare.acme routerName=traefik-secure@docker rule=Host(`traefik.example.com`)

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [December 13, 2025, 7:23am UTC](https://community.traefik.io/t/problem-with-obtaining-certs/29444/2 "2025-12-13T07:23:43Z")

</div>

Cloudflare zone errors are mostly mentioned here, when sub-sub-domains are used, but the sub-domain in CF has not been created.

It could also be that the credentials don’t work for the domain.

Finally there seems to be a network issue, but that would rather be Docker related. Using a VPN or Pi-Hole?

---

<div class="post-metadata">

**Author:** ![mrnoname](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/mrnoname/32/6893_2.png) [@mrnoname](https://community.traefik.io/u/mrnoname)\
**Post date:** [December 13, 2025, 3:05pm UTC](https://community.traefik.io/t/problem-with-obtaining-certs/29444/3 "2025-12-13T15:05:10Z")

</div>

I found the problem…

I’m using a cloud vps and the built in firewall was blocking access, when I turned it off it grabbed a certificate straight away such a small problem for a whole day wasted trying to find a solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [December 16, 2025, 3:05pm UTC](https://community.traefik.io/t/problem-with-obtaining-certs/29444/4 "2025-12-16T15:05:33Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.