Wildcard domains with traefik?

Managed DNS Hosting
1

I recently wanted to to switch to wildcard letsencrypt certificates for my traefik setup (due to trying aggressive geoblocking as I have lots of irrelevant connects from dubious countries, but this also blocks the letsencrypt servers and they do not publish ip addresses to add to a whitelist).
However, it does not really work and gives an error message:
unable to generate a certificate for the domains [domain.org]: error: one or more domains had a problem:\n[*.domain.org] [*.domain.org] acme: error presenting token: desec: no subdomain because the domain and the zone are identical:

Any idea what that means and how I could rectify it?

2

can you share the config?
from the error it seems that maybe you put an extra *. somewhere it doesn’t belong, but i can’t be sure without having a look at the config

3

I had the same issue with Letsencrypt and Traefik when using a wildcard CNAME record with the root domain, i.e.

* CNAME domain.org.

gave the error you mentioned. After switching to

* CNAME server.domain.org.

it worked as expected.

4

Hi, I’m currently struggling with the same wildcard problem. Reto’s solution sadly does not work for me:
*.sub.example.dev. CNAME sub.example.com. with sub.example.com CNAME example.com gives the identical zone error while setting both entries to A and AAAA records with the server’s respective IP gives
propagation: time limit exceeded: last error: [zone=example.com.] could not determine authoritative nameserver

As for my config, the labels on the service are as follows:

traefik.http.routers.name.rule: Host(`sub.example.com`)||HostRegexp(`^.+\.sub.example.com$`)
traefik.http.routers.name.entrypoints: websecure
traefik.http.routers.name.tls.domains[0].main: sub.example.com
traefik.http.routers.name.tls.domains[0].sans: “*.sub.example.com”
traefik.http.routers.name.tls.certresolver: myresolver

For this example, I do own and have control over example.com

Help would be appreciated