# Wildcard certificate does not work

**URL:** <https://community.traefik.io/t/wildcard-certificate-does-not-work/25544>\
**Category:** Traefik v3 (latest)\
**Tags:** docker\
**Created:** [December 12, 2024, 1:09pm UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544 "2024-12-12T13:09:32Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![alexander-sneg](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/alexander-sneg/32/9692_2.png) [@alexander-sneg](https://community.traefik.io/u/alexander-sneg)\
**Post date:** [December 12, 2024, 1:09pm UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/1 "2024-12-12T13:09:32Z")

</div>

Wildcard certificate does not work

I do not receive a wildcard certificate if I use traefik.yml  
The acme.json file does not contain any data  
There are no errors in the logs

Here are my settings:

```auto
global:
  checkNewVersion: false
  sendAnonymousUsage: false

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entrypoint:
          to: websecure
          scheme: https

  websecure:
    address: ":443"
    http:
      tls:
        certResolver: letencrypt
        domains:
          - main: domain.com
            sans:
              - "*.domain.com"

log:
  level: DEBUG

api:
  insecure: true
  dashboard: true

providers:
  docker:
    exposedByDefault: false
  file:
    filename: "/etc/traefik/dynamic_conf.yml"
    watch: true

certificatesResolvers:
  letencrypt:
    acme:
      email: $$$$$@gmail.com
      storage: /cert/acme.json
# caServer: https://acme-v02.api.letsencrypt.org/directory # production (default)
      caServer: https://acme-staging-v02.api.letsencrypt.org/directory # staging
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - 1.1.1.1:53
          - 1.0.0.1:53

```

But if you use labels in docker compose and the traefik.yml settings below, everything works fine.  
The acme.json file contains the data

```auto
- "traefik.http.routers.traefik_secured.tls.certresolver=letencrypt"
- "traefik.http.routers.traefik_secured.tls.domains[0].main=domain.com"
- "traefik.http.routers.traefik_secured.tls.domains[0].sans=*.domain.com"

```

```auto
global:
  checkNewVersion: false
  sendAnonymousUsage: false

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entrypoint:
          to: websecure
          scheme: https

  websecure:
    address: ":443"

log:
  level: DEBUG

api:
  insecure: true
  dashboard: true

providers:
  docker:
    exposedByDefault: false
  file:
    filename: "/etc/traefik/dynamic_conf.yml"
    watch: true

certificatesResolvers:
  letencrypt:
    acme:
      email: $$$$$@gmail.com
      storage: /cert/acme.json
# caServer: https://acme-v02.api.letsencrypt.org/directory # production (default)
      caServer: https://acme-staging-v02.api.letsencrypt.org/directory # staging
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - 1.1.1.1:53
          - 1.0.0.1:53

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [December 12, 2024, 1:25pm UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/2 "2024-12-12T13:25:51Z")

</div>

It should work the way you posted ([doc](https://doc.traefik.io/traefik/routing/entrypoints/#tls)):

```auto
entryPoints:
  websecure:
    address: ':443'
    http:
      tls:
        options: foobar
        certResolver: leresolver
        domains:
          - main: example.com
            sans:
              - foo.example.com
              - bar.example.com

```

Are you sure you supplied the correct DNS credentials via env in both cases?

---

<div class="post-metadata">

**Author:** ![alexander-sneg](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/alexander-sneg/32/9692_2.png) [@alexander-sneg](https://community.traefik.io/u/alexander-sneg)\
**Post date:** [December 12, 2024, 1:40pm UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/3 "2024-12-12T13:40:01Z")

</div>

Yes, I’m sure. Because if I remove these settings from traefik.yml

```auto
    http:
      tls:
        options: foobar
        certResolver: leresolver
        domains:
          - main: example.com
            sans:
              - foo.example.com
              - bar.example.com

```

and configure it differently by adding the labels:

```auto
"traefik.http.routers.traefik_secured.tls.certresolver=letencrypt"
"traefik.http.routers.traefik_secured.tls.domains[0].main=domain.com"
"traefik.http.routers.traefik_secured.tls.domains[0].sans=*.domain.com"

```

I still get the certificate. (The acme.json file contains data for my domain).

I find many tutorials, and as far as I understand, it works for everyone else, but not for me. ☹

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [December 14, 2024, 2:11pm UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/4 "2024-12-14T14:11:15Z")

</div>

It Traefik reading the config file? What’s the debug output?

Share your `docker-compose.yml`.

---

<div class="post-metadata">

**Author:** ![alexander-sneg](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/alexander-sneg/32/9692_2.png) [@alexander-sneg](https://community.traefik.io/u/alexander-sneg)\
**Post date:** [December 14, 2024, 2:58pm UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/5 "2024-12-14T14:58:00Z")

</div>

**docker-compose**

```auto
services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    environment:
      - CF_DNS_API_TOKEN=$$$$$$$$$$$$
    ports:
      - 80:80
      - 443:443
      - 8080:8080 #dashboard
    networks:
      - generic
    volumes:    
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /home/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik_secured.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.traefik_secured.entrypoints=websecure"
      - "traefik.http.routers.traefik_secured.tls=true"

      - "traefik.http.routers.traefik_secured.service=api@internal"
      - "traefik.docker.network=generic"

networks:
  generic:
    name: generic
    external: true

```

**logs**

> **[Common labels: {"container\_name":"traefik","service\_name":"traefik"}Line limit...](https://pastebin.com/5Khusic4)**
>
> Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

---

<div class="post-metadata">

**Author:** ![alexander-sneg](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/alexander-sneg/32/9692_2.png) [@alexander-sneg](https://community.traefik.io/u/alexander-sneg)\
**Post date:** [December 14, 2024, 3:00pm UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/6 "2024-12-14T15:00:59Z")

</div>

sorry, here is the correction

```auto
    volumes:    
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /home/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - /home/traefik/certs:/certs

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [December 15, 2024, 10:39am UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/7 "2024-12-15T10:39:09Z")

</div>

Can you supply the 3 relevant docs in one post?

docker-compose.yml, Traefik static config and dynamic config.

It’s kind of hard to jump around between bits and updated pieces.

---

<div class="post-metadata">

**Author:** ![alexander-sneg](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/alexander-sneg/32/9692_2.png) [@alexander-sneg](https://community.traefik.io/u/alexander-sneg)\
**Post date:** [December 15, 2024, 11:17am UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/8 "2024-12-15T11:17:22Z")

</div>

Hello.  
Yes of course, here are my settings.  
I don't use a dynamic configuration file

(for anonymity:  
[example.com](http://example.com)  
[e-mail@gmail.com](mailto:e-mail@gmail.com))

**traefik.yml**

```auto
global:
  checkNewVersion: false
  sendAnonymousUsage: false

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entrypoint:
          to: websecure
          scheme: https

  websecure:
    address: ":443"
    http:
      tls:
        certResolver: letencrypt
        domains:
          - main: example.com
            sans:
              - "*.example.com"

log:
  level: DEBUG

api:
  insecure: true
  dashboard: true

providers:
  docker:
    exposedByDefault: false

certificatesResolvers:
  letencrypt:
    acme:
      email: e-mail@gmail.com
      storage: /certs/acme.json
# caServer: https://acme-v02.api.letsencrypt.org/directory # production (default)
      caServer: https://acme-staging-v02.api.letsencrypt.org/directory # staging
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - 1.1.1.1:53
          - 1.0.0.1:53

```

**docker compose**

```auto
---
services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    environment:
      - CF_DNS_API_TOKEN=@@@@@@@@@@@
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    networks:
      - generic
    volumes:    
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /home/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - /home/traefik/certs:/certs
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik_secured.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.traefik_secured.entrypoints=websecure"
      - "traefik.http.routers.traefik_secured.tls=true"

      - "traefik.http.routers.traefik_secured.service=api@internal"
      - "traefik.docker.network=generic"

networks:
  generic:
    name: generic
    external: true

```

**logs**

> **[Common labels: {"container\_name":"traefik","service\_name":"traefik"}Line limit...](https://pastebin.com/b4PLKgDg)**
>
> Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [December 15, 2024, 11:22am UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/9 "2024-12-15T11:22:47Z")

</div>

> [@alexander-sneg](#):
>
> `traefik.http.routers.traefik_secured.tls=true`

Try to remove the line. Not sure if it overwrites the LetsEncrypt use from `entrypoint`.

Just `tls=true` is used to enable custom loaded TLS certs, it’s not required for LetsEncrypt, when you assign a `certResolver`.

---

<div class="post-metadata">

**Author:** ![alexander-sneg](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/alexander-sneg/32/9692_2.png) [@alexander-sneg](https://community.traefik.io/u/alexander-sneg)\
**Post date:** [December 15, 2024, 12:00pm UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/10 "2024-12-15T12:00:15Z")

</div>

**Thank you so much, dear friend!!!!!!!!!!**  
I spent almost two weeks unsuccessfully trying to solve this problem!

I thought it wasn't necessary to specify

```auto
- "traefik.http.routers.traefik_secured.entrypoints=websecure"

```

But tls=true is important because it indicates that HTTPS must be used, and therefore, certificatesResolvers.

However, I don't understand why it worked when I used labels along with tls=true.

* * *

My friend, if it's not too much trouble, could you answer one more question?  
I'll say right away, it doesn't relate to the question above.  
But since you helped me solve it, I am converting all the labels from docker-compose to a traefik.yml file.

I plan to set up a second-level subdomain.  
After reading articles and consulting ChatGPT, I came up with two configuration options.  
Which one is correct?

**This is what ChatGPT told me.**  
With these settings, it works:

```auto
      - "traefik.http.routers.wildcard_cert.tls.domains[0].main=example.com"
      - "traefik.http.routers.wildcard_cert.tls.domains[0].sans=*.example.com,*.sub.example.com"

```

**This is how I configured it based on the documentation and forum posts**.  
With these settings, it says: _Domain is duplicated in the configuration or validated by the domain_

```auto
      - "traefik.http.routers.wildcard_cert.tls.domains[0].main=example.com"
      - "traefik.http.routers.wildcard_cert.tls.domains[0].sans=*.example.com"
      - "traefik.http.routers.wildcard_cert.tls.domains[1].main=sub.example.com"
      - "traefik.http.routers.wildcard_cert.tls.domains[1].sans=*.sub.example.com"

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [December 15, 2024, 12:19pm UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/11 "2024-12-15T12:19:08Z")

</div>

> [@alexander-sneg](#):
>
> But tls=true is important because it indicates that HTTPS must be used

No. If a `certResolver` is assigned on `entrypoint` and a `router` is using that `entrypoint`, then you don’t need any TLS declaration on `router`. See [simple Traefik example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt).

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [December 15, 2024, 12:51pm UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/12 "2024-12-15T12:51:36Z")

</div>

Maybe try switching around:

```auto
      - "traefik.http.routers.wildcard_cert.tls.domains[0].main=sub.example.com"
      - "traefik.http.routers.wildcard_cert.tls.domains[0].sans=*.sub.example.com"
      - "traefik.http.routers.wildcard_cert.tls.domains[1].main=example.com"
      - "traefik.http.routers.wildcard_cert.tls.domains[1].sans=*.example.com"

```

Or try ([related post](https://community.traefik.io/t/how-get-multiple-sub-domain-as-sans/5254/2))

```auto
      - "traefik.http.routers.wildcard_cert.tls.domains[0].main=example.com"
      - "traefik.http.routers.wildcard_cert.tls.domains[0].sans=*.example.com,*.sub.example.com"

```

Make sure domain or zone `sub.` os registered with your DND provider.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [December 16, 2024, 10:01am UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/13 "2024-12-16T10:01:20Z")

</div>

Created a [docker-swarm-traefik-dnschallenge example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-swarm-traefik-dnschallenge), which has `dnsChallenge` in `command`. This works for me.

---

<div class="post-metadata">

**Author:** ![alexander-sneg](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/alexander-sneg/32/9692_2.png) [@alexander-sneg](https://community.traefik.io/u/alexander-sneg)\
**Post date:** [December 16, 2024, 10:29am UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/14 "2024-12-16T10:29:53Z")

</div>

In your example you only have:

```auto
example.com
*.example.com

```

And I also have:

```auto
sub.example.com
*sub.example.com

```

Something like this:  
[myapp.example.com](http://myapp.example.com)  
[myapp2.srv1.example.com](http://myapp2.srv1.example.com)

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [December 16, 2024, 10:34am UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/15 "2024-12-16T10:34:13Z")

</div>

This works for me:

```auto
      - --entrypoints.websecure.http.tls.domains[0].main=example.com
      - --entrypoints.websecure.http.tls.domains[0].sans=*.example.com,*.test.example.com

```

---

<div class="post-metadata">

**Author:** ![alexander-sneg](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/alexander-sneg/32/9692_2.png) [@alexander-sneg](https://community.traefik.io/u/alexander-sneg)\
**Post date:** [December 16, 2024, 10:51am UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/16 "2024-12-16T10:51:34Z")

</div>

Yes, me too.  
I was confused by the need to specify `domains[1].main=sub.example.com`.  
That's why I wanted to know for sure what's correct.

* * *

And do these settings work **without DNS Records in Cloudflare,** Is that even possible?

```auto
domains[0].main=example.com"
domains[0].sans=*.example.com,*.sub.example.com"

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [December 16, 2024, 3:22pm UTC](https://community.traefik.io/t/wildcard-certificate-does-not-work/25544/17 "2024-12-16T15:22:47Z")

</div>

For sure you need `example.com`. My provider did not require `sub.`, but that may be dependent on the provider you use.