# Problems to get tls certificates for my docker stack

**URL:** <https://community.traefik.io/t/problems-to-get-tls-certificates-for-my-docker-stack/13846>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [March 21, 2022, 10:53am UTC](https://community.traefik.io/t/problems-to-get-tls-certificates-for-my-docker-stack/13846 "2022-03-21T10:53:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![therealmaass](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/therealmaass/32/5098_2.png) [@therealmaass](https://community.traefik.io/u/therealmaass)\
**Post date:** [March 21, 2022, 10:53am UTC](https://community.traefik.io/t/problems-to-get-tls-certificates-for-my-docker-stack/13846/1 "2022-03-21T10:53:24Z")

</div>

Hello folks,

I'm fairly new to traefik so please bear with me.

I want to get tls certificates for my internal docker applications and tried it for hours to get it to work but had no success. Maybe someone has advice for me. I run a few docker container on my LAN and can reach them via my wildcard dns e.g.: smokeping.internal.foo.bar this works like a charm. To achieve this I used a domain which is registered via cloudflare and points to my local machine. This is my traefik docker-compose file (post tls configuration):

```auto
version: "3.3"    

services:    

  traefik:    
    image: "traefik:v2.5"    
    container_name: "traefik"    
    command:    
      - "--log.level=DEBUG"    
      - "--api.insecure=true"    
      - "--providers.docker=true"    
      - "--providers.docker.exposedbydefault=false"    
      - "--entrypoints.web.address=:80"    
      - "--entryPoints.web-secure.address=:443"    
      - "--certificatesResolvers.primary.acme.email=mymail@mail.com"    
      - "--certificatesResolvers.primary.acme.storage=acme.json"    
      - "--certificatesResolvers.primary.acme.dnsChallenge=true"    
      - "--certificatesResolvers.primary.acme.dnsChallenge.provider=cloudflare"    
      - "--certificatesResolvers.primary.acme.dnsChallenge.delayBeforeCheck=0"    
      - "--certificatesResolvers.primary.acme.dnsChallenge.resolvers=1.1.1.1:53"    
    environment:    
      - CF_API_EMAIL=mymail@mail.com    
      - CF_API_KEY=thisismyapikey    
    ports:    
      - "80:80"    
      - "443:443"    
        # - "8080:8080"    
    volumes:    
      - "/var/run/docker.sock:/var/run/docker.sock:ro"    
      - "/app/traefik/acme.json:/acme.json"    

    restart: unless-stopped    
    labels:    
      - "traefik.enable=true"    
      - "traefik.http.routers.api.rule=Host(`traefik.internal.foo.bar`)"    
      - "traefik.http.routers.api.service=api@internal"    
      - "traefik.http.routers.api.entrypoints=web"    
      # wildcard certs    
      - "traefik.http.routers.api.tls.domains[0].main=internal.foo.bar"    
      - "traefik.http.routers.api.tls.domains[0].sans=*.internal.foo.bar"    
    networks:    
      - web    
networks:    
  web:    
    external: true 

```

This is my e.g. smokeping docker-compose file:

```auto
version: "2.1"    
services:    
  smokeping:    
    image: lscr.io/linuxserver/smokeping    
    container_name: smokeping    
    environment:    
      - PUID=1000    
      - PGID=1000    
      - TZ=Europe/Berlin    
    volumes:    
      - /app/smokeping/config:/config    
      - /app/smokeping/data:/data    
        # ports:    
        # - 80:80    
    networks:    
      - web    
    restart: unless-stopped    
    labels:    
      - "traefik.enable=true"    
      - "traefik.http.routers.smokeping.rule=Host(`smokeping.internal.foo.bar`)"    
      - "traefik.http.routers.smokeping.entrypoints=web-secure"    
      - "traefik.http.routers.smokeping.tls.certResolver=primary"    
networks:    
  web:    
    external: true 

```

This is the traefik log file with the error which causes the problem (well atleast it think this is the problem):

```auto
time="2022-03-21T08:32:39Z" level=error msg="Unable to obtain ACME certificate for domains \"smokeping.internal.foo.bar\": unable to generate a certificate for the domains [smokeping.internal.foo.bar]: error: one or more domains had a problem:\n[smokeping.internal.foo.bar] [smokeping.internal.foo.bar] acme: error presenting token: cloudflare: failed to find zone foo.bar.: ListZonesContext command failed: HTTP status 400: Invalid request headers (6003)\n" routerName=smokeping@docker rule="Host(`smokeping.internal.foo.bar`)" providerName=primary.acme

```

I tried to resolve the hostname within the traefik container and it does work. I also created a API-token for my cloudflare account which has the following abilities: Zone Settings:Read, Zone:Read, DNS:Edit

For reference to build my docker stack i followed this guide: [SensePost | Building a hipster-aware pi home server](https://sensepost.com/blog/2020/building-a-hipster-aware-pi-home-server/) Everything works till the tls configuration: [SensePost | Building a hipster-aware pi home server](https://sensepost.com/blog/2020/building-a-hipster-aware-pi-home-server/#tls)

Maybe someone can help me, thank you in advance!

---

<div class="post-metadata">

**Author:** ![tommoulard](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/tommoulard/32/2997_2.png) [@tommoulard](https://community.traefik.io/u/tommoulard)\
**Post date:** [March 21, 2022, 11:04am UTC](https://community.traefik.io/t/problems-to-get-tls-certificates-for-my-docker-stack/13846/2 "2022-03-21T11:04:51Z")

</div>

Hello @therealmaass,

> [@therealmaass](#):
>
> `cloudflare: failed to find zone foo.bar.`

Your issue seems to come from here. It might be a configuration error on the Cloudflare configuration.

Hope it helps 😃

---

<div class="post-metadata">

**Author:** ![jakubhajek](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jakubhajek/32/3389_2.png) [@jakubhajek](https://community.traefik.io/u/jakubhajek)\
**Post date:** [March 21, 2022, 11:28am UTC](https://community.traefik.io/t/problems-to-get-tls-certificates-for-my-docker-stack/13846/3 "2022-03-21T11:28:07Z")

</div>

> [@therealmaass](#):
>
> ```auto
> time="2022-03-21T08:32:39Z" level=error msg="Unable to obtain ACME certificate for domains \"smokeping.internal.foo.bar\": unable to generate a certificate for the domains [smokeping.internal.foo.bar]: error: one or more domains had a problem:\n[smokeping.internal.foo.bar] [smokeping.internal.foo.bar] acme: error presenting token: cloudflare: failed to find zone foo.bar.: ListZonesContext command failed: HTTP status 400: Invalid request headers (6003)\n" routerName=smokeping@docker rule="Host(`smokeping.internal.foo.bar`)" providerName=primary.acme
> 
> ```

Seems the issue is related to the privileges assigned to the API token. I have found a similar issue on CloudFlare forums. I hope that helps, please let us know.

[https://community.cloudflare.com/t/api-token-for-traefik-dns-challenge/132084](https://community.cloudflare.com/t/api-token-for-traefik-dns-challenge/132084)