traefik: Wildcard domain certificate generation with route 53 fails.
Do you want to request a feature or report a bug?
Bug
What did you do?
I’m using the traefik 1.7 docker image. When run docker container to create wildcard domains, I get time out. As soon as I run the container, I can see the TXT in route 53 as shown in the image. For some reason Traefik cannot validate it.
What did you expect to see?
Wildcard subdomains to be allowed.
What did you see instead?
Here is the error I get (changed the actual domain):
time="2018-09-30T16:01:53Z" level=error msg="Error obtaining certificate: acme: Error -> One or more domains had a problem:\n[example.com.com] Time limit exceeded. Last error: NS ns-1416.awsdns-49.org. did not return the expected TXT record\n"
time="2018-09-30T16:01:53Z" level=error msg="Unable to obtain ACME certificate for domains \"*.example.com.com,example.com.com\" : unable to generate a certificate for the domains [*.example.com.com example.com.com]: acme: Error -> One or more domains had a problem:\n[example.com.com] Time limit exceeded. Last error: NS ns-1416.awsdns-49.org. did not return the expected TXT record\n"
- My acme.json is created just fine.
- I see the TXT for acme in route 53:
- I tried deleting the acme.json file and restarting the container multiple times. No resolution here!
- Setting a delay of 60s did not fix this.
Thanks in advance for any help.
_Originally posted by @gurumark in https://github.com/containous/traefik/issues/3468#issuecomment-425732727_
What is your environment & configuration (arguments, toml, provider, platform, …)?
configuration
About this issue
- Original URL
- State: closed
- Created 6 years ago
- Reactions: 2
- Comments: 25 (12 by maintainers)
The fix will come with 1.7.3
@gurumark thanks for the spot!
And thanks @ldez for the fix! Also wondering, since I don’t know the average velocity of lego PRs / traefik RCs: how many weeks from now would be a reasonable estimate for this to be on an RC / release?
That hit the spot!
I was able to generate a valid
acme.json
with the ff.ldez/traefik:route53
Route53 Policy:
acme.json:
Traefik / ACME Debug Logs:
Looking back on it: My previous policy was this: (I wasn’t able to find any info on the Traefik docs regarding IAM setup for the AWS user so this was when I winged it) It worked back when using MAIN=something.com and multiple subdomain SANs, so I assumed that it should be fine for wildcard + root
Previous Route53 Policy:
Is anyone else also seeing success?
You have to update your policies:
I updated the image. Could you pull again the image and retry?