# Traefik requesting certs from letsencrypt for invalid (unconfigured) sub domains?

**URL:** <https://community.traefik.io/t/traefik-requesting-certs-from-letsencrypt-for-invalid-unconfigured-sub-domains/5321>\
**Category:** Traefik v1\
**Tags:** letsencrypt-acme\
**Created:** [April 6, 2020, 8:14am UTC](https://community.traefik.io/t/traefik-requesting-certs-from-letsencrypt-for-invalid-unconfigured-sub-domains/5321 "2020-04-06T08:14:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![traeefik\_user1](https://avatars.discourse-cdn.com/v4/letter/t/bc8723/32.png) [@traeefik\_user1](https://community.traefik.io/u/traeefik_user1)\
**Post date:** [April 6, 2020, 8:14am UTC](https://community.traefik.io/t/traefik-requesting-certs-from-letsencrypt-for-invalid-unconfigured-sub-domains/5321/1 "2020-04-06T08:14:03Z")

</div>

I configure numerous standalone docker containers to answer at subdomains using docker labels with the following format:

```auto
    labels:
      - "traefik.docker.network=mynet"
      - "traefik.enable=true"
      - "traefik.frontend.headers.SSLRedirect=true"
      - "traefik.frontend.rule=Host:${INSTANCE_NAME}.validdomain.tld"
      - "traefik.protocol=https"
      - "traefik.port=8443"

```

This has worked for years. This morning trying to spin up an instance failed with some obscure HTTPS message `SSL_ERROR_INTERNAL_ERROR_ALERT`.

Upon investigating further I found numerous strange entries in the acme.toml file. I removed the key and certs and replaces the domain information with validsub.validdomain.tld :

```auto
    {
      "Domain": {
        "Main": "dev.validsub.validdomain.tld",
        "SANs": null
      },
      "Certificate": "",
      "Key": ""
    },
    {
      "Domain": {
        "Main": "old.validsub.validdomain.tld",
        "SANs": null
      },
      "Certificate": "",
      "Key": ""
    },
    {
      "Domain": {
        "Main": "shop.validsub.validdomain.tld",
        "SANs": null
      },
      "Certificate": "",
      "Key": ""
    },
    {
      "Domain": {
        "Main": "test.validsub.validdomain.tld",
        "SANs": null
      },
      "Certificate": "",
      "Key": ""
    },
    {
      "Domain": {
        "Main": "demo.validsub.validdomain.tld",
        "SANs": null
      },
      "Certificate": "",
      "Key": ""
    },
    {
      "Domain": {
        "Main": "magento.validsub.validdomain.tld",
        "SANs": null
      },
      "Certificate": "",
      "Key": ""
    },
    {
      "Domain": {
        "Main": "staging.validsub.validdomain.tld",
        "SANs": null
      },
      "Certificate": "",
      "Key": ""
    },
    {
      "Domain": {
        "Main": "store.validsub.validdomain.tld",
        "SANs": null
      },
      "Certificate": "",
      "Key": ""
    },
    {
      "Domain": {
        "Main": "www.demo.validsub.validdomain.tld",
        "SANs": null
      },
      "Certificate": "",
      "Key": ""
    },

```

It looks to me, like a networks scanner was looking for some sort of system to exploit. It found none, but these unwanted domain certificates have AFAICT taken up my contingent on letsencrypt certificates meaning I cannot spin up new instances. Can it be that traefik is pulling certs for subdomains before checking if they are even being served by this proxy?

Can I configure something to avoid this from happening?

---

<div class="post-metadata">

**Author:** ![arapoport](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/arapoport/32/7713_2.png) [@arapoport](https://community.traefik.io/u/arapoport)\
**Post date:** [October 16, 2023, 1:48pm UTC](https://community.traefik.io/t/traefik-requesting-certs-from-letsencrypt-for-invalid-unconfigured-sub-domains/5321/2 "2023-10-16T13:48:20Z")

</div>

I have the same problem, a lot of strange entries that prevent the certificates to be renewed. Have you found any solution to this issue @traeefik_user1 ? Thanks !