Setting up a new Traefik instance, getting an error I have never seen and I am a bit confused. time="2022-02-16T21:48:20Z" level=error msg="Unable to obtain ACME certificate for domains \"cloud.grillgeek.se\": unable to generate a certificate for the domains [cloud.grillgeek.se]: error: one or more…

Now I created a new token, tested it with success added it to Traefik, after a down and up no errors.

Hello @macmattias , [image] macmattias: acme: error presenting token: cloudflare: failed to create TXT record: HTTP status 403: Authentication error It seems that traefik cannot connect to Cloudflare. Did you have any issue in setting the corresponding configuration (e.g. CF_API_EMAIL, CF_API…

No, when you create a token you get a curl-string to test it, and I did and it worked. I got no issues with the internet or anything the only thing that might be an issue but still not is that my internal DNS is using Unbound.

Then, this might be a Cloudflare token issue. Check out this documentation of lego that can help you with Cloudflare token : Cloudflare :: Let’s Encrypt client and ACME library written in Go.

Does the CloudFlare token that has been created have permission to add DNS entries to the zone? As a workaround, you can try to use GlobalToken and see if the issue still exists. Then you can create the token with appropriate permission to add DNS entries to your domains.

I checked my docker-compose and it seems I have used my Global API Token. I get the same errors using a token setup to be able to edit my dns.

I did some research and I found that if you use API keys ( CF_API_EMAIL and CF_API_KEY ), the Global API Key needs to be used, not the Origin CA Key. however, there are also some limitations regarding the DDNS update for some TLD's. Maybe that will help to explain that specific behavior: https://go…

This worked without any issues like this before the server hosting all this crashed and I am rebuilding everything from scratch. (Backups? I was a victim of the Proxmox 7 backup bug...) The only thing that has changed is that I have removed a ddns docker image and let pfSense take care of that inst…

Congrats! So the root cause of the issue was an invalid CF token. Thanks for you update :wink:

Traefik and Cloudflare unable to obtain certificate

Traefik Traefik v2

tommoulard February 17, 2022, 8:15am 2

Hello @macmattias,

It seems that traefik cannot connect to Cloudflare. Did you have any issue in setting the corresponding configuration (e.g. CF_API_EMAIL, CF_API_KEY or CF_DNS_API_TOKEN, [CF_ZONE_API_TOKEN])?

Topic		Replies	Views
Traefik "Unable to obtain ACME certificate for domains" Traefik v2 docker	2	6012	March 9, 2020
problem with obtaining certs Traefik v3 (latest) docker	3	75	December 13, 2025
Unable to obtain ACME Certificate cloudflare inside traefik Traefik v3 (latest) letsencrypt-acme	8	415	February 14, 2025
Issue with acme-challenge using Cloudflare DNS Traefik v2 docker , letsencrypt-acme	5	8447	June 16, 2024
Unable to obtain ACME certificate: Cloudflare did not return the expected TXT record Traefik v3 (latest) docker	1	810	January 14, 2025

Traefik and Cloudflare unable to obtain certificate

Related topics