# Traefik SSL issue
**URL:** https://community.traefik.io/t/traefik-ssl-issue/29548
**Category:** Traefik
**Tags:** docker
**Created:** [January 6, 2026, 4:21pm UTC](https://community.traefik.io/t/traefik-ssl-issue/29548 "2026-01-06T16:21:38Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@rohit-bayer-ind](https://community.traefik.io/u/rohit-bayer-ind)
#### Post date: [January 6, 2026, 4:21pm UTC](https://community.traefik.io/t/traefik-ssl-issue/29548/1 "2026-01-06T16:21:38Z")
Hi Community Members ,
we have traeefik with version 3.6.4 running as a docker container inside aws ecs service
it has an efs mounted volume file system
redis as a dynamic configuration provider
**static configuration are defined as cli command as follows**
```auto
{
"command": [
"--api.insecure=true",
"--log.format=json",
"--log.level=DEBUG",
"--entrypoints.web.address=:80",
"--entrypoints.web.transport.respondingtimeouts.idletimeout=20",
"--entrypoints.web.transport.respondingtimeouts.readtimeout=20",
"--entrypoints.web.transport.respondingtimeouts.writetimeout=20",
"--entrypoints.websecure.address=:443",
"--entrypoints.websecure.http.tls.certResolver=lestandard",
"--entrypoints.websecure.transport.respondingtimeouts.idletimeout=60",
"--entrypoints.websecure.transport.respondingtimeouts.readtimeout=60",
"--entrypoints.websecure.transport.respondingtimeouts.writetimeout=60",
"--certificatesresolvers.lestandard.acme.email="XXXX",
"--certificatesresolvers.lestandard.acme.dnschallenge=true",
"--certificatesresolvers.lestandard.acme.dnschallenge.provider=route53",
"--certificatesresolvers.lestandard.acme.storage=/mount/efs-certs/acme.json",
"--providers.providersThrottleDuration=60s",
"--providers.redis.endpoints="XXXX":6379",
"--providers.redis.tls.insecureSkipVerify=true"
],
```
it mainly is used for redirecting old domains to new ones & let'sencrypt is the ssl provider
acme challenge type is HTTP-01
port 80, 443 for entrypoint web /websecure are all open from public internet
suddenly acme-challenge domain validation starts failing for which we were unable to figure out the root cause
**Error Logs**
December 15, 2025, 19:28
{"level":"error","providerName":"lestandard.acme","acmeCA":"[https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory)",
"providerName":"lestandard.acme","ACME CA":"[https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory)",
"routerName":"[websecure-moinak.dutta.ext.baywsf.com](http://websecure-moinak.dutta.ext.baywsf.com)@redis",
"rule":"Host(`moinak.dutta.ext.baywsf.com`)","error":"unable to generate a certificate for the domains [moinak.dutta.ext.baywsf.com]:
error: one or more domains had a problem:\n[moinak.dutta.ext.baywsf.com] invalid authorization: acme:
error: 400 :: urn:ietf:params:acme:error:connection :: 63.180.28.137:
Fetching [http://moinak.dutta.ext.baywsf.com/.well-known/acme-challenge/Ko9mS0Yr3I5ol\_Yg8mNpN09bHOP6JCBR1RYkxwEtftM:](http://moinak.dutta.ext.baywsf.com/.well-known/acme-challenge/Ko9mS0Yr3I5ol_Yg8mNpN09bHOP6JCBR1RYkxwEtftM:)
Timeout during connect (likely firewall problem)\n","domains":["[moinak.dutta.ext.baywsf.com](http://moinak.dutta.ext.baywsf.com)"],"time":"2025-12-15T13:58:59Z",
"caller":"[github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:501","message":"Unable](http://github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:501%22,%22message%22:%22Unable) to obtain ACME certificate for domains"}
sample dynamic rules in redis for a test domain i.e. [redirector-debug.baywsf.com](http://redirector-debug.baywsf.com)
**Redis Keys**
Redis\_Domain:6379\> keys redirector/domains/"[redirector-debug.baywsf.com](http://redirector-debug.baywsf.com)"
1. "redirector/domains/redirector-debug.baywsf.com"
Redis\_Domain:6379\> keys _redirector_
1. "traefik/http/middlewares/redirector-debug.baywsf.com\_redirect\_0/redirectregex/replacement"
2. "traefik/http/routers/redirector-debug.baywsf.com/service"
3. "redirector/domains/redirector-debug.baywsf.com"
4. "traefik/http/routers/redirector-debug.baywsf.com/entryPoints/0"
5. "traefik/http/middlewares/redirector-debug.baywsf.com\_redirect\_0/redirectregex/permanent"
6. "traefik/http/routers/redirector-debug.baywsf.com/rule"
7. "traefik/http/routers/redirector-debug.baywsf.com/middlewares/0"
8. "traefik/http/routers/redirector-debug.baywsf.com/entryPoints/1"
9. "traefik/http/middlewares/redirector-debug.baywsf.com\_redirect\_0/redirectregex/regex"
10. "traefik/http/middlewares/redirector-debug.baywsf.com\_chain/chain/middlewares"
**Screenshot of traefik dashboard router / service**
**nslookup of the same domain to showcase there is no ipv6 or AAAA record but still this issue is happening .**
---
### Author:  [@bluepuma77](https://community.traefik.io/u/bluepuma77)
#### Post date: [January 6, 2026, 4:26pm UTC](https://community.traefik.io/t/traefik-ssl-issue/29548/2 "2026-01-06T16:26:09Z")
`dnsChallenge` uses a TXT DNS record to verify, no request to `.well-known` path.
---
### Author:  [@rohit-bayer-ind](https://community.traefik.io/u/rohit-bayer-ind)
#### Post date: [January 7, 2026, 10:57am UTC](https://community.traefik.io/t/traefik-ssl-issue/29548/3 "2026-01-07T10:57:52Z")
we tried DNS Automated Validation as an alternative approach , but as our domain register CSC Corporation which does not has an API Support with Lego Library , we had to fall back on manual DNS Challenge TXT record Validation
But unfortunately that also is not working as the ECS service where traeffik is running , it is not waiting for TXT Record getting added and before that it is triggering acme challenge which is failing .
Below is the screenshot of manual config , Any help is appreciated .
```auto
"--certificatesresolvers.lestandard.acme.dnschallenge.provider=manual",
"--certificatesresolvers.lestandard.acme.dnsChallenge.propagation.delayBeforeChecks=300",
"--certificatesresolvers.lestandard.acme.dnsChallenge.propagation.disableChecks=true",
```