# Unable to generate wildcard certificates properly for multiple domains **URL:** \ **Category:** Traefik v2\ **Tags:** letsencrypt-acme, docker\ **Created:** [September 16, 2023, 7:56am UTC](https://community.traefik.io/t/unable-to-generate-wildcard-certificates-properly-for-multiple-domains/19839 "2023-09-16T07:56:36Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![xd003](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/xd003/32/7571_2.png) [@xd003](https://community.traefik.io/u/xd003)\ **Post date:** [September 16, 2023, 7:56am UTC](https://community.traefik.io/t/unable-to-generate-wildcard-certificates-properly-for-multiple-domains/19839/1 "2023-09-16T07:56:36Z")
I am intending to generate multiple wildcard certificates using cloudflare dnschallenge for multiple domains. For instance - 1. Cert1 - `example.com` & `*.example..com` 2. Cert2 - `adguard.example.com` & `*.adguard.example.com` Here is my full docker-compose for traefik, i don't use anything else to configure traefik - [https://pastebin.com/raw/GGAAwXBj](https://pastebin.com/raw/GGAAwXBj) Pointing out the most relevant section from the compose ```auto - "--entrypoints.websecure.http.tls.domains[0].main=example.com" - "--entrypoints.websecure.http.tls.domains[0].sans=*.example.com" - "--entrypoints.websecure.http.tls.domains[1].main=adguard.example.com" - "--entrypoints.websecure.http.tls.domains[1].sans=*.adguard.example.com" ``` Here is a link to my redacted acme.json file - [https://pastebin.com/raw/fbrtuKb4](https://pastebin.com/raw/fbrtuKb4). As evident from above json file, the first certificate is generated fine namely `example.com` & `*.example.com` are correctly present inside `main` and `sans` block but for the second certificate, `*.adguard.example.com` is directly present in the `main` block while `sans` block is missing altogether. Traefik version 3.0.0-beta3 Ubuntu 22.04 & Docker ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [September 16, 2023, 9:04am UTC](https://community.traefik.io/t/unable-to-generate-wildcard-certificates-properly-for-multiple-domains/19839/2 "2023-09-16T09:04:40Z")
Try following the [doc](https://doc.traefik.io/traefik/routing/entrypoints/#tls). Make sure all sub-domains are resolved for an IP. ```auto --entrypoints.websecure.http.tls.domains[0].main=example.com --entrypoints.websecure.http.tls.domains[0].sans=*.example.com --entrypoints.websecure.http.tls.domains[1].main=sub1.example.com --entrypoints.websecure.http.tls.domains[1].sans=*.sub1.example.com ``` or try ```auto --entrypoints.websecure.http.tls.domains[0].main=example.com --entrypoints.websecure.http.tls.domains[0].sans=*.example.com,*.sub1.example.com ``` ---
**Author:** ![xd003](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/xd003/32/7571_2.png) [@xd003](https://community.traefik.io/u/xd003)\ **Post date:** [September 16, 2023, 9:34am UTC](https://community.traefik.io/t/unable-to-generate-wildcard-certificates-properly-for-multiple-domains/19839/3 "2023-09-16T09:34:09Z")
I did knew about this one but quite unsure if it would work as intended Correct me if i am wrong, assuming the following creates a wildcard certificate for [example.com](http://example.com) ```auto --entrypoints.websecure.http.tls.domains[0].main=example.com --entrypoints.websecure.http.tls.domains[0].sans=*.example.com ``` And assuming the below creates a wildcard certificate for [sub1.example.com](http://sub1.example.com) ```auto --entrypoints.websecure.http.tls.domains[1].main=sub1.example.com --entrypoints.websecure.http.tls.domains[1].sans=*.sub1.example.com ``` The first wildcard certificate is fine but in the second one i need a single combined certificate of wildcard for sub1 & sub1 itself ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [September 16, 2023, 10:04am UTC](https://community.traefik.io/t/unable-to-generate-wildcard-certificates-properly-for-multiple-domains/19839/4 "2023-09-16T10:04:57Z")
Isn’t that what’s happening? Have you tested? ---
**Author:** ![xd003](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/xd003/32/7571_2.png) [@xd003](https://community.traefik.io/u/xd003)\ **Post date:** [September 16, 2023, 11:28am UTC](https://community.traefik.io/t/unable-to-generate-wildcard-certificates-properly-for-multiple-domains/19839/6 "2023-09-16T11:28:59Z")
Unfortunately i am not even able to access the traefik dashboard itself for some reason, pretty sure the certificates wouldn't have been generated too. Logs - [https://pastes.io/raw/uiqmj2628x](https://pastes.io/raw/uiqmj2628x) ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [September 16, 2023, 12:01pm UTC](https://community.traefik.io/t/unable-to-generate-wildcard-certificates-properly-for-multiple-domains/19839/7 "2023-09-16T12:01:20Z")
Share your full Traefik static and dynamic config, and `docker-compose.yml` if used. Did you read the error? ```auto error="unable to get ACME account: permissions 755 for /letsencrypt/acme.json are too open, please use 600" ``` ---
**Author:** ![xd003](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/xd003/32/7571_2.png) [@xd003](https://community.traefik.io/u/xd003)\ **Post date:** [September 16, 2023, 12:19pm UTC](https://community.traefik.io/t/unable-to-generate-wildcard-certificates-properly-for-multiple-domains/19839/8 "2023-09-16T12:19:49Z")
Here's my whole traefik docker compose - [https://pastebin.com/raw/GGAAwXBj](https://pastebin.com/raw/GGAAwXBj). I don't use anything else to configure traefik **Edit - i fixed all acme issues by fixing my volume mounts.** Proceeding forward, i checked for the original problem for which this thread was posted, it didn't seemed to have went as expected, have a look at my redacted acme.json file here - [https://pastebin.com/raw/fbrtuKb4](https://pastebin.com/raw/fbrtuKb4) Here is a link to my redacted acme.json file - [https://pastebin.com/raw/fbrtuKb4](https://pastebin.com/raw/fbrtuKb4). As evident from above json file, the first certificate is generated fine namely `example.com` & `*.example.com` are correctly present inside `main` and `sans` block but for the second certificate, `*.adguard.example.com` is directly present in the `main` block while `sans` block is missing altogether. After much digging, i still haven't been able to find anything substantial yet ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\ **Post date:** [September 19, 2023, 12:20pm UTC](https://community.traefik.io/t/unable-to-generate-wildcard-certificates-properly-for-multiple-domains/19839/11 "2023-09-19T12:20:43Z")
This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.