What I try to do
I am trying to get a wildcard certificate for a subdomain like *.marktest.dev.mobilea.nl for a registered domain with TransIP using the DNS challenge, since I use internal IP addresses to get certificated for. The domain that is registered would be mobilea.nl.
Also I am using the tutorial from DockerSwarm.rocks with some modification to use the DNS challenge instead.
DNS settings mobilea.nl
Here the related DNS settings from the TransIP panel, which are correctly configured, since I have more of these configurations working on the domain for other purposes.:
| Name | TTL | Type | Value |
|---|---|---|---|
| marktest.dev | 1 min. | A | 172.22.22.5 |
| *.marktest.dev | 1 min. | A | 172.22.22.5 |
Modifications docker-compose.yml from tutorial DockerSwarm.rocks
The docker secret is created earlier and the environment variables are set correctly.
traefik:
...
secrets:
- source: transip_key
command: >
...
# --acme.httpChallenge.entryPoint=http
--acme.dnsChallenge.provider="transip"
#--acme.onhostrule=true
--acme.domains="*.marktest.dev.mobilea.nl"
...
-logLevel=DEBUG
...
environment:
- TRANSIP_ACCOUNT_NAME=${TRANSIP_ACCOUNT_NAME?Variable TRANSIP_ACCOUNT_NAME not set}
- TRANSIP_PRIVATE_KEY_PATH=${TRANSIP_PRIVATE_KEY_PATH?Variable TRANSIP_PRIVATE_KEY_PATH not set}
Filtered output on acme
6time="2019-07-23T09:08:48Z" level=debug msg="Global configuration loaded {\"LifeCycle\":{\"RequestAcceptGraceTimeout\":0,\"GraceTimeOut\":10000000000},\"GraceTimeOut\":0,\"Debug\":false,\"CheckNewVersion\":true,\"SendAnonymousUsage\":false,\"AccessLogsFile\":\"\",\"AccessLog\":{\"format\":\"common\"},\"TraefikLogsFile\":\"\",\"TraefikLog\":null,\"Tracing\":null,\"LogLevel\":\"DEBUG\",\"EntryPoints\":{\"http\":{\"Address\":\":80\",\"TLS\":null,\"Redirect\":null,\"Auth\":null,\"WhitelistSourceRange\":null,\"WhiteList\":null,\"Compress\":false,\"ProxyProtocol\":null,\"ForwardedHeaders\":{\"Insecure\":true,\"TrustedIPs\":null}},\"https\":{\"Address\":\":443\",\"TLS\":{\"MinVersion\":\"\",\"CipherSuites\":null,\"Certificates\":[],\"ClientCAFiles\":null,\"ClientCA\":{\"Files\":null,\"Optional\":false},\"DefaultCertificate\":null,\"SniStrict\":false},\"Redirect\":null,\"Auth\":null,\"WhitelistSourceRange\":null,\"WhiteList\":null,\"Compress\":false,\"ProxyProtocol\":null,\"ForwardedHeaders\":{\"Insecure\":true,\"TrustedIPs\":null}},\"traefik\":{\"Address\":\":8080\",\"TLS\":null,\"Redirect\":null,\"Auth\":null,\"WhitelistSourceRange\":null,\"WhiteList\":null,\"Compress\":false,\"ProxyProtocol\":null,\"ForwardedHeaders\":{\"Insecure\":true,\"TrustedIPs\":null}}},\"Cluster\":{\"Node\":\"0baf9f6b-eb5f-42f4-8f56-95c53536e77b\",\"Store\":{\"Store\":{},\"Prefix\":\"traefik\"}},\"Constraints\":[\"tag==traefik-public\"],\"ACME\":{\"Email\":\"mark@mobilea.nl\",\"Domains\":[{\"Main\":\"*.marktest.dev.mobilea.nl\",\"SANs\":null}],\"Storage\":\"traefik/acme/account\",\"StorageFile\":\"\",\"OnDemand\":false,\"OnHostRule\":true,\"CAServer\":\"https://acme-v02.api.letsencrypt.org/directory\",\"EntryPoint\":\"https\",\"KeyType\":\"\",\"DNSChallenge\":{\"Provider\":\"transip\",\"DelayBeforeCheck\":10000000000,\"Resolvers\":null,\"DisablePropagationCheck\":false},\"HTTPChallenge\":null,\"TLSChallenge\":null,\"DNSProvider\":\"\",\"DelayDontCheckDNS\":0,\"ACMELogging\":true,\"OverrideCertificates\":false,\"TLSConfig\":null},\"DefaultEntryPoints\":[\"http\"],\"ProvidersThrottleDuration\":2000000000,\"MaxIdleConnsPerHost\":200,\"IdleTimeout\":0,\"InsecureSkipVerify\":false,\"RootCAs\":null,\"Retry\":null,\"HealthCheck\":{\"Interval\":30000000000},\"RespondingTimeouts\":null,\"ForwardingTimeouts\":null,\"AllowMinWeightZero\":false,\"KeepTrailingSlash\":false,\"Web\":null,\"Docker\":{\"Watch\":true,\"Filename\":\"\",\"Constraints\":null,\"Trace\":false,\"TemplateVersion\":2,\"DebugLogGeneratedTemplate\":false,\"Endpoint\":\"unix:///var/run/docker.sock\",\"Domain\":\"\",\"TLS\":null,\"ExposedByDefault\":false,\"UseBindPortIP\":false,\"SwarmMode\":true,\"Network\":\"\",\"SwarmModeRefreshSeconds\":15},\"File\":null,\"Marathon\":null,\"Consul\":{\"Watch\":true,\"Filename\":\"\",\"Constraints\":[],\"Trace\":false,\"TemplateVersion\":0,\"DebugLogGeneratedTemplate\":false,\"Endpoint\":\"consul-leader:8500\",\"Prefix\":\"traefik\",\"TLS\":null,\"Username\":\"\",\"Password\":\"\"},\"ConsulCatalog\":null,\"Etcd\":null,\"Zookeeper\":null,\"Boltdb\":null,\"Kubernetes\":null,\"Mesos\":null,\"Eureka\":null,\"ECS\":null,\"Rancher\":null,\"DynamoDB\":null,\"ServiceFabric\":null,\"Rest\":null,\"API\":{\"EntryPoint\":\"traefik\",\"Dashboard\":true,\"Debug\":false,\"CurrentConfigurations\":null,\"Statistics\":null},\"Metrics\":null,\"Ping\":null,\"HostResolver\":null}",
time="2019-07-23T09:08:49Z" level=debug msg="Building ACME client...",
time="2019-07-23T09:08:49Z" level=info msg="Starting ACME renew job...",
time="2019-07-23T09:08:50Z" level=debug msg="No ACME certificate to generate for domains [\"consul.marktest.dev.mobilea.nl\"].",
time="2019-07-23T09:08:50Z" level=debug msg="No ACME certificate to generate for domains [\"traefik.marktest.dev.mobilea.nl\"].",
time="2019-07-23T09:08:50Z" level=info msg="Retrieving ACME certificates...",
time="2019-07-23T09:08:50Z" level=debug msg="Loading ACME certificates [*.marktest.dev.mobilea.nl]...",
time="2019-07-23T09:08:50Z" level=info msg="legolog: [INFO] [*.marktest.dev.mobilea.nl] acme: Obtaining bundled SAN certificate",
time="2019-07-23T09:08:50Z" level=info msg="legolog: [INFO] [*.marktest.dev.mobilea.nl] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/xjVymJwDH30c3UwvTBWE8kOBlCk_--0Cci-rIwoe04w",
time="2019-07-23T09:08:50Z" level=info msg="legolog: [INFO] [*.marktest.dev.mobilea.nl] acme: use dns-01 solver",
time="2019-07-23T09:08:50Z" level=info msg="legolog: [INFO] [*.marktest.dev.mobilea.nl] acme: Preparing to solve DNS-01",
time="2019-07-23T09:08:53Z" level=info msg="legolog: [INFO] [*.marktest.dev.mobilea.nl] acme: Trying to solve DNS-01",
time="2019-07-23T09:08:53Z" level=info msg="legolog: [INFO] [*.marktest.dev.mobilea.nl] acme: Checking DNS record propagation using [127.0.0.11:53]",
time="2019-07-23T09:09:11Z" level=info msg="legolog: [INFO] [*.marktest.dev.mobilea.nl] acme: Cleaning DNS-01 challenge",
time="2019-07-23T09:09:13Z" level=info msg="legolog: [INFO] Unable to deactivated authorizations: https://acme-v02.api.letsencrypt.org/acme/authz/xjVymJwDH30c3UwvTBWE8kOBlCk_--0Cci-rIwoe04w",
time="2019-07-23T09:09:13Z" level=error msg="Error getting ACME certificate for domain [\"*.marktest.dev.mobilea.nl\"]: cannot obtain certificates: acme: Error -> One or more domains had a problem:\n[*.marktest.dev.mobilea.nl] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: No TXT record found at _acme-challenge.marktest.dev.mobilea.nl, url: \n",
time="2019-07-23T09:09:13Z" level=info msg="Retrieved ACME certificates",
time="2019-07-23T09:09:13Z" level=debug msg="No ACME certificate to generate for domains [\"consul.marktest.dev.mobilea.nl\"].",
time="2019-07-23T09:09:13Z" level=debug msg="No ACME certificate to generate for domains [\"traefik.marktest.dev.mobilea.nl\"]."
What i would expect?
I would expect the TXT records are created and validated so the certificate would be created.
Any ideas what I am doing wrong here?
