Maybe try switching around:
- "traefik.http.routers.wildcard_cert.tls.domains[0].main=sub.example.com"
- "traefik.http.routers.wildcard_cert.tls.domains[0].sans=*.sub.example.com"
- "traefik.http.routers.wildcard_cert.tls.domains[1].main=example.com"
- "traefik.http.routers.wildcard_cert.tls.domains[1].sans=*.example.com"
Or try (related post)
- "traefik.http.routers.wildcard_cert.tls.domains[0].main=example.com"
- "traefik.http.routers.wildcard_cert.tls.domains[0].sans=*.example.com,*.sub.example.com"
Make sure domain or zone sub.
os registered with your DND provider.