1

I'm trying to set-up a reverse proxy with wildcard SSL using Traefik, with a DNS challenge against a Cloudflare zone.

I have this config in k8s:

kind: ConfigMap
apiVersion: v1
metadata:
  name: traefik-https
  namespace: kube-system
data:
  traefik.toml: |
    # traefik.toml
    defaultEntryPoints = ["http","https"]
    [entryPoints]
      [entryPoints.http]
      address = ":80"
      [entryPoints.http.redirect]
      entryPoint = "https"
      [entryPoints.https]
      address = ":443"
      [entryPoints.https.tls]
    [acme]
    email = "notmyrealemail@example.com"
    storage = "/etc/traefik/acme.json"
    entryPoint = "https"
    caServer = "https://acme-v02.api.letsencrypt.org/directory"
    [[acme.domains]]
    main = "*.notmyrealsite.com"
    sans = ["notmyrealsite.com"]
    [acme.dnsChallenge]
    provider = "cloudflare"

I'm passing the right CLOUDFLARE_API_KEY and CLOUDFLARE_EMAIL env vars in the upstream container, but I'm seeing this error in the console:

time="2018-06-13T09:47:39Z" level=error msg="Unable to obtain ACME certificate for domains \"*.notmyrealsite.com,notmyrealsite.com\" : cannot obtain certificates: acme: Error -> One or more domains had a problem:\n[notmyrealsite.com] acme: Error 403 - urn:ietf:params:acme:error:unauthorized - Incorrect TXT record \"HREckyrZXY7uCVLaUkoYzadxkHbwfFavNWS_v14yMzk\" found at _acme-challenge.notmyrealsite.com\n"

I'm not sure whether this means the CF login is successful and has been updated (but just with the wrong TXT record), or whether that's what it's expecting to see - and nothing is there.

Looking at the DNS entries in CF reveals no TXT records at all.

(I'm only on the free CF plan, so I don't get any raw logs to see what attempts were made against the DNS)

What could be causing the TXT mismatch?

Lee Benson
  • 143
  • 7

1 Answers1

0

More a work-around than a solution:

Instead of:

[[acme.domains]]
  main = "*.example.org"
  sans = ["example.org"]

Use:

[[acme.domains]]
  main = "*.example.org"

[[acme.domains]]
  main = "example.org"
Reto Gmür
  • 101
  • 1