# TLS challenge validation fails **URL:** \ **Category:** Traefik v2\ **Tags:** letsencrypt-acme\ **Created:** [May 29, 2023, 12:52pm UTC](https://community.traefik.io/t/tls-challenge-validation-fails/18757 "2023-05-29T12:52:03Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![grindsa](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/grindsa/32/7171_2.png) [@grindsa](https://community.traefik.io/u/grindsa)\ **Post date:** [May 29, 2023, 12:52pm UTC](https://community.traefik.io/t/tls-challenge-validation-fails/18757/1 "2023-05-29T12:52:03Z")
Hi, I am maintaining a [Non-Letsencrypt ACME server implementation](https://github.com/grindsa/acme2certifier). One of my users did contact me claiming that certificate enrollment does not work when using [tls-alpn-01 challenge validation](https://doc.traefik.io/traefik/user-guides/docker-compose/acme-tls/). I think i was able to replicate the issue in my lab by using [your reference config](https://doc.traefik.io/traefik/user-guides/docker-compose/acme-tls/) with some smaller modifications. ```auto version: '3.3' services: traefik: image: traefik:latest container_name: "traefik" command: - "--log.level=DEBUG" - "--api.insecure=true" - "--providers.docker=true" - "--providers.docker.exposedbydefault=false" - "--entrypoints.web.address=:80" - "--entrypoints.websecure.address=:443" - "--certificatesresolvers.myresolver.acme.tlschallenge=true" # - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web" - "--certificatesresolvers.myresolver.acme.caserver=http://192.168.14.1/directory" - "--certificatesresolvers.myresolver.acme.email=grindsa@foo.bar" - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json" ports: - "80:80" - "443:443" - "8080:8080" volumes: - "./letsencrypt:/letsencrypt" - "/var/run/docker.sock:/var/run/docker.sock" whoami: image: traefik/whoami labels: - "traefik.enable=true" - "traefik.http.routers.whoami.rule=Host(`whoami.bar.local`)" - "traefik.http.routers.whoami.entrypoints=web,websecure" # - "traefik.http.routers.whoami.entrypoints=websecure" - "traefik.http.routers.whoami.tls.certresolver=myresolver" ``` I see that the challenge validation failes on the acme-server as the certificate presented by traeffik is wrong/missing the respective SAN and certificate extension fields. Below an example certificate which gets presented to acme-server. ```auto -----BEGIN CERTIFICATE----- MIIDXjCCAkagAwIBAgIRAOmGOJ9jzfO1hZSSYdfGCKwwDQYJKoZIhvcNAQELBQAw HzEdMBsGA1UEAxMUVFJBRUZJSyBERUZBVUxUIENFUlQwHhcNMjMwNTI5MTIxMzIy WhcNMjQwNTI4MTIxMzIyWjAfMR0wGwYDVQQDExRUUkFFRklLIERFRkFVTFQgQ0VS VDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANJMdTn+gKgI6IRvyWOV /QNibiCCA0OOq//1fh/xzGjuhE+KB2gOaSZ/2eazV5X/8n5EcZMVxcy0z0/+piBe bAmE5qnf5OHyWBrjLv5E/rgoEU4tNKAqI+0yzS/1CXFb0c18/Bz4nm45Z+ISlNJU rNLj72nO/xxZZkOdqgDtJdd0PyQkUUk0qMJGYiG37yQgSRv0rohZB+MYenvj8Ebr psxWYHNoeV4jVlMmQQ53euTUjoMBEudVht/ox81cW+Pvf+/2RByLawAZE+uY/K6O N/li4BlP25dGbkNoJapO0S41rzRlKi1ne2nZPSeiJkvGWKS4C0q2wRwOKa6AddoU wesCAwEAAaOBlDCBkTAOBgNVHQ8BAf8EBAMCA7gwEwYDVR0lBAwwCgYIKwYBBQUH AwEwDAYDVR0TAQH/BAIwADBcBgNVHREEVTBTglEwNjdhNmZkM2QyYWUzMDZkY2Jj MGQ5MjhmMGY2MTgzMS5jOTU2ZDU4MzM5NDk1OTc4ZDRiZDMxYWE2ZmZhOTkyZC50 cmFlZmlrLmRlZmF1bHQwDQYJKoZIhvcNAQELBQADggEBAExSSlZhSQ984FAlLbCv 7E8DwEh+tAb2noupQSgjp1r1J+29hXtCvPNoAQOw2ZcXFyVQeQ+nYLhN8DLJNcHc SvrJ9u/q1h9bPi+ft36QQ1UF/NUCM6RIQDkf7kDIUvdD41m0WkRVTyT6RZiK8K3+ x2NIUcAd4JyrZSXe1Hil2bgGtqzz9+UuFO0Hv/FuK81v3m74ZPZAYX1q2Eyux/q7 4011AP9PWX7G2HfN+m7GpbBgBtQVxGG9hAdu1RcfENGGlHtmAyeoLz3kjxcIFksH PUjNDhv3LgHtIkzu7CWiF9AeariOKCmnXefOXAZT37Jj4rckFk9mKHJjnVCvr23a 03U= -----END CERTIFICATE----- ``` CN=TRAEFIK DEFAULT CERT SAN=DNS:067a6fd3d2ae306dcbc0d928f0f61831.c956d58339495978d4bd31aa6ffa992d.traefik.default Is my configuration incomplete or did i get hit by a bug? Thank you for your help and have a nice day. /G. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [May 29, 2023, 4:38pm UTC](https://community.traefik.io/t/tls-challenge-validation-fails/18757/2 "2023-05-29T16:38:10Z")
Your setup probably does not work because you have a private hostname. For LetsEncrypt validation you need a public domain name. Optionally check this [simple Traefik example](https://github.com/bluepuma77/traefik-best-practice). ---
**Author:** ![grindsa](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/grindsa/32/7171_2.png) [@grindsa](https://community.traefik.io/u/grindsa)\ **Post date:** [May 29, 2023, 7:34pm UTC](https://community.traefik.io/t/tls-challenge-validation-fails/18757/3 "2023-05-29T19:34:51Z")
I am not using LE but a private acme server which does allow private domains. Further challenge validation via http-01 works without issues. Only when using tls-alpn-01 validation fails as my traefik instance does present the wrong certificate vor validation. BR G. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [May 29, 2023, 7:52pm UTC](https://community.traefik.io/t/tls-challenge-validation-fails/18757/4 "2023-05-29T19:52:33Z")
Traefik uses [le-go](https://github.com/go-acme/lego), maybe their community can help better. They probably have a similar forum. ---
**Author:** ![grindsa](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/grindsa/32/7171_2.png) [@grindsa](https://community.traefik.io/u/grindsa)\ **Post date:** [May 30, 2023, 2:16pm UTC](https://community.traefik.io/t/tls-challenge-validation-fails/18757/5 "2023-05-30T14:16:47Z")
Thank you for your answer. I meanwhile found the issue by myself. It seems that Traefik routes the validation requests coming from the acme-server based on the ALPN extension included in the ClientHello message. This was missing in my implementation. After adding the extension with a correct protocol name ("acme-tls/1") everything works as expected. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\ **Post date:** [June 2, 2023, 2:17pm UTC](https://community.traefik.io/t/tls-challenge-validation-fails/18757/6 "2023-06-02T14:17:22Z")
Closed on June 2, 2023, 2:17pm UTC This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.