# Subdomain-only certificate with letsencrypt

**URL:** <https://community.traefik.io/t/subdomain-only-certificate-with-letsencrypt/24997>\
**Category:** Traefik v3 (latest)\
**Tags:** letsencrypt-acme, docker\
**Created:** [October 31, 2024, 2:27am UTC](https://community.traefik.io/t/subdomain-only-certificate-with-letsencrypt/24997 "2024-10-31T02:27:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![PeterDraex](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/peterdraex/32/5375_2.png) [@PeterDraex](https://community.traefik.io/u/PeterDraex)\
**Post date:** [October 31, 2024, 2:27am UTC](https://community.traefik.io/t/subdomain-only-certificate-with-letsencrypt/24997/1 "2024-10-31T02:27:51Z")

</div>

Hi,

I have one server that runs on `example.com` and another server that runs on `sub.example.com`. I'd like to use traefik on `sub.example.com`. The issue is that when it tries to get a certificate, it tries for the domain `example.com`, and the verification fails, because it's another server. I've tried this configuration:

```auto
labels:
      - "traefik.enable=true"
      - "traefik.http.routers.old.rule=(Host(`sub.example.com`) || Host(`example2.com`))"
      - "traefik.http.routers.old.entrypoints=websecure"
      - "traefik.http.routers.old.tls=true"
      - "traefik.http.routers.old.tls.certresolver=letsencrypt"
      - "traefik.http.routers.old.tls.domains[0].main=sub.example.com"
      - "traefik.http.routers.old.tls.domains[0].sans=www.sub.example.com"

```

and the logs show:

```auto
2024-10-31T02:20:55Z ERR Error renewing certificate from LE: {example.com [sub.example.com]} error="error: one or more domains had a problem:\n[example.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: 100.99.137.137: Invalid response from https://example.com/.well-known/acme-challenge/V9hnkpJbsjtSS6lfObVROlFlC2xWCMbTtqJjlNDOk9g: 500\n" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=letsencrypt.acme

```

How can I issue a certificate only for the subdomain?  
Thanks!

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [October 31, 2024, 9:47am UTC](https://community.traefik.io/t/subdomain-only-certificate-with-letsencrypt/24997/2 "2024-10-31T09:47:45Z")

</div>

`main` and `sans` is usually used with wildcard certs, which require `dnsChallenge`, which needs access to DNS provider.

LetsEncrypt will usually work with `httpChallenge` and `tlsChallenge`, when using only `Host()` for the used domain(s). Try to remove `main`/`sans`.

---

<div class="post-metadata">

**Author:** ![unsanded](https://avatars.discourse-cdn.com/v4/letter/u/74df32/32.png) [@unsanded](https://community.traefik.io/u/unsanded)\
**Post date:** [January 23, 2025, 8:03pm UTC](https://community.traefik.io/t/subdomain-only-certificate-with-letsencrypt/24997/3 "2025-01-23T20:03:20Z")

</div>

Hi,

DId you ever find out how to do this. I have a similar problem. For me the reason is that my rule looks like this:`HOST(one.example.org) || (HOST(two.example.org) && PathPrefix('/path') `  
Only [one.example.org](http://one.example.org) doesn't get a certificate

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 23, 2025, 8:27pm UTC](https://community.traefik.io/t/subdomain-only-certificate-with-letsencrypt/24997/4 "2025-01-23T20:27:43Z")

</div>

Usually this just works:

```auto
Host(`one.example.org`) || Host(`two.example.org`)

```

I doubt that the parenthesis change anything, but for fun you could try without.

Share your full Traefik static and dynamic config, and `docker-compose.yml` if used.

Enable and check Traefik debug log ([doc](https://doc.traefik.io/traefik/observability/logs/#level)) and Traefik access log in JSON format ([doc](https://doc.traefik.io/traefik/observability/access-logs/#format)).