# Wildcard Letsencrypt certificate for subdomain doesn't works with Dynu (domain provider) **URL:** \ **Category:** Traefik v2\ **Tags:** letsencrypt-acme\ **Created:** [December 30, 2023, 11:15am UTC](https://community.traefik.io/t/wildcard-letsencrypt-certificate-for-subdomain-doesnt-works-with-dynu-domain-provider/20919 "2023-12-30T11:15:26Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![tsla](https://avatars.discourse-cdn.com/v4/letter/t/34f0e0/32.png) [@tsla](https://community.traefik.io/u/tsla)\ **Post date:** [December 30, 2023, 11:15am UTC](https://community.traefik.io/t/wildcard-letsencrypt-certificate-for-subdomain-doesnt-works-with-dynu-domain-provider/20919/1 "2023-12-30T11:15:26Z")
I was trying to get some Traefik Letsencrypt wildcard certificate for a subdomain of my domain `(*.local.example.com)`, the certificates for previous level of the domain was working fine `(example.com, local.example.com, *.example.com)` but for `*.local.example.com` specifically I receive an error: `[| level=error msg="Unable to obtain ACME certificate for domains \"*.local.example.com\"" providerName=dynu.acme routerName=traefik-secure@docker rule="Host(`[traefik-dashboard.local.example.com](http://traefik-dashboard.local.example.com)`)" error="unable to generate a certificate for the domains [*.local.example.com]: error: one or more domains had a problem:\n[*.local.example.com] propagation: time limit exceeded: last error: NS ns4.dynu.com. did not return the expected TXT record [fqdn: _acme-challenge.local.example.com., value: pq9bdnM5LL9Sv-K1XzPrwy-NqkTrcaK3mJq0HRLk29W]: \n" ACME CA="https://acme-v02.api.letsencrypt.org/directory"].` Because the exact same setup was working with Cloudflare, and the previous level of the domain works just fine, as well as the fact that the proper acme challenge DNS record were still being created for `*.local.example.com`, I conclude that the issue is probably because Dynu resolver can't return the proper DNS record for some reason, and in fact I have encountered this issue once before when I was using `Nginx Proxy Manager`, and the solution was to create a new third level domain `(local.example.com)` (this is Dynu specific), and to create the DNS record directly within the third level domain. However, Traefik works using the API and their doesn't seem to be a way to tell the docker compose file to create the DNS record in the third level domain instead of the top level one. May be there is a solution on the Traefik end somehow, like getting it to create the acme challenge in a specific domain, or other possible solution? If you can come up with any then please let me know as soon as possible, the new year is coming and my deadline of this deployment is due tomorrow. I appreciate your support. - - As you can see here the Dynu DNS records can be split into top level and third level domain, and their DNS records are separated ![image](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/6/66b4636d61c15f19bcd93a5c9f3b6fa397a58014.png) - My docker compose file: ```auto version: '3' services: traefik: image: traefik:latest container_name: traefik restart: unless-stopped security_opt: - no-new-privileges:true networks: - proxy ports: - 80:80 - 443:443 environment: - DYNU_API_KEY= volumes: - /etc/localtime:/etc/localtime:ro - /var/run/docker.sock:/var/run/docker.sock:ro - /srv/docker_data/traefik/data/traefik.yml:/traefik.yml:ro - /srv/docker_data/traefik/data/acme.json:/acme.json - /srv/docker_data/traefik/data/config.yml:/config.yml:ro labels: - "traefik.enable=true" - "traefik.http.routers.traefik.entrypoints=http" - "traefik.http.routers.traefik.rule=Host(`traefik-dashboard.local.example.com`)" - "traefik.http.middlewares.traefik-auth.basicauth.users=CREDENTIALS" - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https" - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https" - "traefik.http.routers.traefik.middlewares=traefik-https-redirect" - "traefik.http.routers.traefik-secure.entrypoints=https" - "traefik.http.routers.traefik-secure.rule=Host(`traefik-dashboard.local.example.com`)" - "traefik.http.routers.traefik-secure.middlewares=traefik-auth" - "traefik.http.routers.traefik-secure.tls=true" - "traefik.http.routers.traefik-secure.tls.certresolver=dynu" - "traefik.http.routers.traefik-secure.tls.domains[0].main=example.com" - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.example.com" - "traefik.http.routers.traefik-secure.tls.domains[1].main=local.example.com" - "traefik.http.routers.traefik-secure.tls.domains[1].sans=*.local.example.com" - "traefik.http.routers.traefik-secure.service=api@internal" networks: proxy: external: true ``` - My traefik.yml file: ```auto api: dashboard: true debug: true entryPoints: http: address: ":80" http: redirections: entryPoint: to: https scheme: https https: address: ":443" serversTransport: insecureSkipVerify: true providers: docker: endpoint: "unix:///var/run/docker.sock" exposedByDefault: false file: filename: /config.yml certificatesResolvers: dynu: acme: email: example@example.com storage: acme.json dnsChallenge: provider: dynu ``` Again, thanks a lot for your support. 😄 ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [December 30, 2023, 1:43pm UTC](https://community.traefik.io/t/wildcard-letsencrypt-certificate-for-subdomain-doesnt-works-with-dynu-domain-provider/20919/2 "2023-12-30T13:43:49Z")
I think you need to create `local.example.com` in DNS if you want to create a second level wildcard. ---
**Author:** ![tsla](https://avatars.discourse-cdn.com/v4/letter/t/34f0e0/32.png) [@tsla](https://community.traefik.io/u/tsla)\ **Post date:** [December 30, 2023, 4:32pm UTC](https://community.traefik.io/t/wildcard-letsencrypt-certificate-for-subdomain-doesnt-works-with-dynu-domain-provider/20919/3 "2023-12-30T16:32:27Z")
Can you explain it clearer on how I can do that please? ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [December 30, 2023, 6:39pm UTC](https://community.traefik.io/t/wildcard-letsencrypt-certificate-for-subdomain-doesnt-works-with-dynu-domain-provider/20919/4 "2023-12-30T18:39:45Z")
I don’t know, it depends on your DNS provider. In general I would create an A record with the Traefik IP. ---
**Author:** ![tsla](https://avatars.discourse-cdn.com/v4/letter/t/34f0e0/32.png) [@tsla](https://community.traefik.io/u/tsla)\ **Post date:** [December 30, 2023, 6:55pm UTC](https://community.traefik.io/t/wildcard-letsencrypt-certificate-for-subdomain-doesnt-works-with-dynu-domain-provider/20919/5 "2023-12-30T18:55:29Z")
Yeah, I did create an A record with the Traefik IP already (from before when I was still using NPM) and it still doesn't work, also, by IP do you mean the local or the public one? But either way I have an a record of them both Picture for reference (this is the [local.example.com](http://local.example.com) third level domain record section, separated from the top level [example.com](http://example.com) section) ![image](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/3/3dc1a8995eaf0463070945bf954e5eff02bb6af2.png) ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [December 31, 2023, 8:15am UTC](https://community.traefik.io/t/wildcard-letsencrypt-certificate-for-subdomain-doesnt-works-with-dynu-domain-provider/20919/6 "2023-12-31T08:15:05Z")
Enable and check Traefik debug log ([doc](https://doc.traefik.io/traefik/observability/logs/#level)). You can also set `delayBeforeCheck` to manually check if the TXT entry was created ([doc](https://doc.traefik.io/traefik/https/acme/#providers), at end of providers): > By default, the `provider` verifies the TXT record _before_ letting ACME verify. You can delay this operation by specifying a delay (in seconds) with `delayBeforeCheck` (value must be greater than zero). ---
**Author:** ![tsla](https://avatars.discourse-cdn.com/v4/letter/t/34f0e0/32.png) [@tsla](https://community.traefik.io/u/tsla)\ **Post date:** [December 31, 2023, 7:11pm UTC](https://community.traefik.io/t/wildcard-letsencrypt-certificate-for-subdomain-doesnt-works-with-dynu-domain-provider/20919/7 "2023-12-31T19:11:44Z")
Well, the lucky thing is I figured out some crap and finally got a different error: `time="2023-12-31T19:05:08Z" level=error msg="Unable to obtain ACME certificate for domains \"*.local.example.com\"" error="unable to generate a certificate for the domains [*.local.example.com]: error: one or more domains had a problem:\n[*.local.example.com] propagation: time limit exceeded: last error: NS ns4.dynu.com. returned NXDOMAIN for _acme-challenge.local.example.com.\n" providerName=dynu.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=traefik-secure@docker rule="Host(`[traefik-dashboard.local.example.com](http://traefik-dashboard.local.example.com)`)"` Also, now Firefox doesn't allow me to visit the websites at all instead of just saying it's insecure But the bad thing is I still have no idea on how to solve it, so I would greatly appreciate it if you lend me a hand on this one ---
**Author:** ![tsla](https://avatars.discourse-cdn.com/v4/letter/t/34f0e0/32.png) [@tsla](https://community.traefik.io/u/tsla)\ **Post date:** [December 31, 2023, 7:39pm UTC](https://community.traefik.io/t/wildcard-letsencrypt-certificate-for-subdomain-doesnt-works-with-dynu-domain-provider/20919/8 "2023-12-31T19:39:01Z")
Update: I went and mess around with the `delayBeforeCheck` , and finally got it working with `delayBeforeCheck: 60` But there is still a question I want to ask: will their be any future consequences (error or other stuff that ) when using this `delayBeforeCheck` parameter? I mean it kinda feel like a workaround ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [December 31, 2023, 9:14pm UTC](https://community.traefik.io/t/wildcard-letsencrypt-certificate-for-subdomain-doesnt-works-with-dynu-domain-provider/20919/9 "2023-12-31T21:14:55Z")
> [@tsla](#): > > delayBeforeCheck I don’t think there are any issues, it just waits a bit for the DNS data propagation, so that all DNS servers have the same new data available. ---
**Author:** ![tsla](https://avatars.discourse-cdn.com/v4/letter/t/34f0e0/32.png) [@tsla](https://community.traefik.io/u/tsla)\ **Post date:** [January 2, 2024, 5:18pm UTC](https://community.traefik.io/t/wildcard-letsencrypt-certificate-for-subdomain-doesnt-works-with-dynu-domain-provider/20919/10 "2024-01-02T17:18:52Z")
Thanks a lot, but unfortunately I have encountered another issue so I'm hoping you could come over with it. That would be great ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\ **Post date:** [January 5, 2024, 5:19pm UTC](https://community.traefik.io/t/wildcard-letsencrypt-certificate-for-subdomain-doesnt-works-with-dynu-domain-provider/20919/11 "2024-01-05T17:19:37Z")
This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.