# Struggling w/ simplest of DNS01 challanages 'hello world' examples

**URL:** <https://community.traefik.io/t/struggling-w-simplest-of-dns01-challanages-hello-world-examples/21704>\
**Category:** Traefik v3 (latest)\
**Tags:** cli\
**Created:** [March 4, 2024, 2:03am UTC](https://community.traefik.io/t/struggling-w-simplest-of-dns01-challanages-hello-world-examples/21704 "2024-03-04T02:03:15Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![johntdyer](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/johntdyer/32/8329_2.png) [@johntdyer](https://community.traefik.io/u/johntdyer)\
**Post date:** [March 4, 2024, 2:03am UTC](https://community.traefik.io/t/struggling-w-simplest-of-dns01-challanages-hello-world-examples/21704/1 "2024-03-04T02:03:15Z")

</div>

So I am strugging w/ the seemingly simplest of examples...

my compose file is as foillows

## Docker Compose

```auto
 traefik:
    container_name: traefik
    hostname: traefik.dyer.house
    image: traefik:v3.0
    restart: always
    command:
      - --configFile=/traefik/traefik.yml

    env_file:
      - ./.env

    networks:
      - proxy
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /etc/localtime:/etc/localtime:ro
      - traefik_data:/traefik
      - traefik_cert:/letsencrypt
    
  whoami:
    image: traefik/whoami
    container_name: traefik-whoami
    networks:
      - proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.mywhoami.tls=true
      - traefik.http.routers.mywhoami.rule=Host(`whoami.dyer.house`)
      - traefik.http.routers.mywhoami.entrypoints=websecure,web

```

Then my traefik.yml file

```auto
api:
  insecure: true
  dashboard: true
  debug: true

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    http:
      tls: true
    address: ":443"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: proxy

    watch: true
log:
  level: DEBUG

certificatesResolvers:
  letsencrypt:
    acme:
      # Staging
      # caserver: https://acme-staging-v02.api.letsencrypt.org/directory
      email: xxxxxx@xxxx.com
      storage: /letsencrypt/acme.json
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"
        delayBeforeCheck: 5s

```

Startup logs as follows:

> <https://gist.github.com/johntdyer/45179dca1599195bfca0631cb9f2c6a2>

I am never seeing it actually issue a valid cert...

```auto
░▒▓    ~ ▓▒░ curl -Lv http://whoami.dyer.house ░▒▓ 60 ✘  at 20:57:48  ▓▒░
* Trying 192.168.100.3:80...
* Connected to whoami.dyer.house (192.168.100.3) port 80
> GET / HTTP/1.1
> Host: whoami.dyer.house
> User-Agent: curl/8.4.0
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
< Location: https://whoami.dyer.house/
< Date: Mon, 04 Mar 2024 02:02:32 GMT
< Content-Length: 17
<
* Ignoring the response-body
* Connection #0 to host whoami.dyer.house left intact
* Clear auth, redirects to port from 80 to 443
* Issue another request to this URL: 'https://whoami.dyer.house/'
* Trying 192.168.100.3:443...
* Connected to whoami.dyer.house (192.168.100.3) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/cert.pem
* CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
░▒▓    ~ ▓▒░

```

Unsure how best to proceed... Any help would be appreciated. Thanks

-John

---

<div class="post-metadata">

**Author:** ![johntdyer](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/johntdyer/32/8329_2.png) [@johntdyer](https://community.traefik.io/u/johntdyer)\
**Post date:** [March 4, 2024, 2:05am UTC](https://community.traefik.io/t/struggling-w-simplest-of-dns01-challanages-hello-world-examples/21704/2 "2024-03-04T02:05:51Z")

</div>

I am tried numerous times to delete the acme.json file to get it to issue a cert but it never seemingly issues a value one. At this point I am rate limited and giving up for the night but hoping someone else can spot what I am sure is a stupid error somewhere in my work.. Thanks again

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [March 4, 2024, 5:49am UTC](https://community.traefik.io/t/struggling-w-simplest-of-dns01-challanages-hello-world-examples/21704/3 "2024-03-04T05:49:45Z")

</div>

Where is your network definition in `docker-compose.yml`?

Use `curl -k` to access the insecure website and check the response, if it reaches the target service.

* * *

You set `tls=true`, but that only enables custom TLS. You need to assign the certresolver, preferably to `entrypoint` (or to `router`).

Check and compare to [simple Traefik example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt).

---

<div class="post-metadata">

**Author:** ![johntdyer](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/johntdyer/32/8329_2.png) [@johntdyer](https://community.traefik.io/u/johntdyer)\
**Post date:** [March 4, 2024, 12:03pm UTC](https://community.traefik.io/t/struggling-w-simplest-of-dns01-challanages-hello-world-examples/21704/4 "2024-03-04T12:03:14Z")

</div>

The network is there, i just didnt include it in my excerpt from the yaml....

Here is the verbose curl... what exactly am i looking for ?

```auto
░▒▓    ~ ▓▒░ curl -Lkv http://whoami.dyer.house ░▒▓ 60 ✘  at 21:02:32  ▓▒░
* Trying 192.168.100.3:80...
* Connected to whoami.dyer.house (192.168.100.3) port 80
> GET / HTTP/1.1
> Host: whoami.dyer.house
> User-Agent: curl/8.4.0
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
< Location: https://whoami.dyer.house/
< Date: Mon, 04 Mar 2024 12:01:43 GMT
< Content-Length: 17
<
* Ignoring the response-body
* Connection #0 to host whoami.dyer.house left intact
* Clear auth, redirects to port from 80 to 443
* Issue another request to this URL: 'https://whoami.dyer.house/'
* Trying 192.168.100.3:443...
* Connected to whoami.dyer.house (192.168.100.3) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted h2
* Server certificate:
* subject: CN=TRAEFIK DEFAULT CERT
* start date: Mar 4 01:57:42 2024 GMT
* expire date: Mar 4 01:57:42 2025 GMT
* issuer: CN=TRAEFIK DEFAULT CERT
* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://whoami.dyer.house/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: whoami.dyer.house]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.4.0]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: whoami.dyer.house
> User-Agent: curl/8.4.0
> Accept: */*
>
< HTTP/2 200
< content-type: text/plain; charset=utf-8
< date: Mon, 04 Mar 2024 12:01:43 GMT
< content-length: 372
<
Hostname: e267d3534521
IP: 127.0.0.1
IP: 172.27.0.3
RemoteAddr: 172.27.0.2:60154
GET / HTTP/1.1
Host: whoami.dyer.house
User-Agent: curl/8.4.0
Accept: */*
Accept-Encoding: gzip
X-Forwarded-For: 192.168.100.121
X-Forwarded-Host: whoami.dyer.house
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: traefik.dyer.house
X-Real-Ip: 192.168.100.121

* Connection #1 to host whoami.dyer.house left intact
░▒▓    ~ ▓▒░

```

---

<div class="post-metadata">

**Author:** ![johntdyer](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/johntdyer/32/8329_2.png) [@johntdyer](https://community.traefik.io/u/johntdyer)\
**Post date:** [March 4, 2024, 12:17pm UTC](https://community.traefik.io/t/struggling-w-simplest-of-dns01-challanages-hello-world-examples/21704/5 "2024-03-04T12:17:04Z")

</div>

Updated logs based on your example.... still no valid cert

> <https://gist.github.com/johntdyer/deb9274662b71cdc4179c9ed5a785e85>

---

<div class="post-metadata">

**Author:** ![johntdyer](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/johntdyer/32/8329_2.png) [@johntdyer](https://community.traefik.io/u/johntdyer)\
**Post date:** [March 4, 2024, 12:18pm UTC](https://community.traefik.io/t/struggling-w-simplest-of-dns01-challanages-hello-world-examples/21704/6 "2024-03-04T12:18:32Z")

</div>

I stand corrected, the cert is working now.... so now I need to diff and understand what from your example I am overlooking.. Thanks for the example

-