# Traefik serves default certificate when using wildcard domain **URL:** \ **Category:** Traefik v2\ **Tags:** letsencrypt-acme\ **Created:** [October 16, 2024, 3:45pm UTC](https://community.traefik.io/t/traefik-serves-default-certificate-when-using-wildcard-domain/24798 "2024-10-16T15:45:29Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![J7mbo](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/j7mbo/32/1841_2.png) [@J7mbo](https://community.traefik.io/u/J7mbo)\ **Post date:** [October 16, 2024, 3:45pm UTC](https://community.traefik.io/t/traefik-serves-default-certificate-when-using-wildcard-domain/24798/1 "2024-10-16T15:45:29Z")
The goal: - Have traefik ask letsencrypt to generate a wildcard certificate ✅ - Visiting a valid subdomain will use the certificate, and be valid ✅ - Every http call will be redirected to https ✅ - Visiting a non-existant subdomain will show a 404 page, with a valid https cert ❌ The problem: - Visiting a non-existent subdomain shows traefik's default cert is being served. Configuration: > **commands (docker-compose.yml)** > > ```auto > command: > - "--log.level=DEBUG" > - "--providers.docker=true" > - "--providers.docker.network=app_network" > - "--providers.docker.exposedbydefault=false" > - "--providers.file.filename=/etc/traefik/dynamic.yml" > - "--providers.file.watch=true" > - '--entryPoints.http.address=:80' > - '--entryPoints.http.http.redirections.entryPoint.to=https' > - '--entryPoints.http.http.redirections.entryPoint.scheme=https' > - '--entryPoints.http.http.redirections.entryPoint.permanent=true' > - '--entryPoints.https.address=:443' > - '--certificatesresolvers.lets_encrypt_resolver.acme.email=myemail@email.com' > - '--certificatesresolvers.lets_encrypt_resolver.acme.storage=/acme.json' > - '--certificatesresolvers.lets_encrypt_resolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory' # @todo remove > - '--certificatesresolvers.lets_encrypt_resolver.acme.dnschallenge=true' > - '--certificatesresolvers.lets_encrypt_resolver.acme.dnschallenge.provider=digitalocean' > - '--certificatesresolvers.lets_encrypt_resolver.acme.dnschallenge.delaybeforecheck=0' > - '--entrypoints.https.http.tls.domains[0].main=mydomain.com' > - '--entrypoints.https.http.tls.domains[0].sans=*.mydomain.com' > - '--entrypoints.https.http.tls.certresolver=lets_encrypt_resolver' > > ``` > **dynamic.yml** > > ```auto > tls: > # traefik will terminate SSL and then communicate with self-signed certs internally. > certificates: > - certFile: /certs/cert.pem > keyFile: /certs/key.pem > > http: > serversTransports: > myTransport: > serverName: "app" > rootCAs: > - /certs/rootCA.pem > > routers: > app: > rule: Host(`app.mydomain.com`) > service: app > entryPoints: > - https > tls: > certResolver: lets_encrypt_resolver > > services: > app: > loadBalancer: > serversTransport: myTransport > servers: > - url: 'https://app:8080' > > ``` The above configuration does work for valid subdomains. I can visit [https://app.mydomain.com](https://app.mydomain.com) and I am served a valid https certificate along with my internal application serving the content via its own TLS cert. The problem is, when I visit [https://randomsubdomainthatdoesntexist.mydomain.com](https://randomsubdomainthatdoesntexist.mydomain.com), I am served with a browser warning and traefik's default certificate is being served. Instead, I would like it to show me the standard 404. My expectation was that having a wildcard certificate would enable this, which is why I switched from the HTTP challenge to the DNS challenge. Was I incorrect? What am I missing? ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [October 16, 2024, 6:21pm UTC](https://community.traefik.io/t/traefik-serves-default-certificate-when-using-wildcard-domain/24798/2 "2024-10-16T18:21:09Z")
Usually every sub-domain needs a DNS entry to resolve to an IP. You created those? You can set a custom TLS cert as default ([doc](https://doc.traefik.io/traefik/https/tls/#default-certificate)). It is also possible to use a LetsEncrypt cert as default ([doc](https://doc.traefik.io/traefik/https/tls/#acme-default-certificate)). ---
**Author:** ![J7mbo](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/j7mbo/32/1841_2.png) [@J7mbo](https://community.traefik.io/u/J7mbo)\ **Post date:** [October 17, 2024, 10:00am UTC](https://community.traefik.io/t/traefik-serves-default-certificate-when-using-wildcard-domain/24798/3 "2024-10-17T10:00:58Z")
> Usually every sub-domain needs a DNS entry to resolve to an IP. You created those? Yes, I have a wildcard certificate for those. Actually, looking at the docs, I can't see how to set the LE cert as the default one for all unknown subdomains: ```auto stores: default: defaultGeneratedCert: resolver: lets_encrypt_resolver domain: main: mydomain.com sans: - *.mydomain.com ``` The example only shows concrete domains specified in the `sans` field... -- What do I need to do, so that I when I visit `unknownsubdomain.mydomain.com`, it does not show a https warning and instead redirects to [mydomain.com](http://mydomain.com), or anywhere else? -- Edit: Solution is: - Wildcard cert - Redirect all http to https (I already had this) - Low priority route that forwards everything to another domain via middleware Here's the redirect router: ```auto redirectUnknownSubdomain: rule: PathPrefix(`/`) priority: 1 entryPoints: - https middlewares: - redirectUnknownSubdomain service: redirectUnknownSubdomain tls: certResolver: lets_encrypt_resolver domains: - main: {{env "DOMAIN"}} - sans: '*.{{env "DOMAIN"}}' ``` and the redirect service: ```auto redirectUnknownSubdomain: loadBalancer: servers: - url: https://www.google.com ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\ **Post date:** [October 20, 2024, 10:01am UTC](https://community.traefik.io/t/traefik-serves-default-certificate-when-using-wildcard-domain/24798/4 "2024-10-20T10:01:46Z")
Closed on October 20, 2024, 10:01am UTC This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.