When I delete a public resource from Pangolin, Pangolin still requests certificates for that subdomain. I regularly get certificate transparency reports for certificates issued from Lets Encrypt to subdomains that I used to have as a resource in pangolin and have since been deleted.
Environment
OS Type & Version: Ubuntu 24.04
Pangolin Version: 1.15.1
Gerbil Version: 1.3.0
Traefik Version: 3.6.7
Newt Version: 1.9.0
Olm Version: (if applicable)
To Reproduce
Create a public resource in Pangolin
After a certificate has been issued for the resource's subdomain and is available in Pangolin, delete the resource
When certificate renewal comes around, Pangolin will renew the certificate of the deleted resource's subdomain
Expected Behavior
Certificate issuance and renewals are only requested for subdomains connected to existing resources.
Originally created by @eldridgea on GitHub (Jan 30, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2382
### Describe the Bug
When I delete a public resource from Pangolin, Pangolin still requests certificates for that subdomain. I regularly get certificate transparency reports for certificates issued from Lets Encrypt to subdomains that I used to have as a resource in pangolin and have since been deleted.
### Environment
- OS Type & Version: Ubuntu 24.04
- Pangolin Version: 1.15.1
- Gerbil Version: 1.3.0
- Traefik Version: 3.6.7
- Newt Version: 1.9.0
- Olm Version: (if applicable)
### To Reproduce
1. Create a public resource in Pangolin
2. After a certificate has been issued for the resource's subdomain and is available in Pangolin, delete the resource
3. When certificate renewal comes around, Pangolin will renew the certificate of the deleted resource's subdomain
### Expected Behavior
Certificate issuance and renewals are only requested for subdomains connected to existing resources.
Using http validation method I assume? If so that's intended traefik stuff.. Check your acme.json file
<!-- gh-comment-id:3837731150 -->
@AstralDestiny commented on GitHub (Feb 2, 2026):
Using http validation method I assume? If so that's intended traefik stuff.. Check your acme.json file
@github-actions[bot] commented on GitHub (Feb 17, 2026):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
<!-- gh-comment-id:3911192631 -->
@github-actions[bot] commented on GitHub (Feb 17, 2026):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@LaurenceJJones commented on GitHub (Feb 19, 2026):
Not a bug in pangolin per say, simply this is how traefik the underlying webserver for pangolin currently handles this for http challenges. The workaround as by traefik standards is to manually prune your acme.json or there are some tools on github that the community have made but use at own risk.
<!-- gh-comment-id:3925263381 -->
@LaurenceJJones commented on GitHub (Feb 19, 2026):
Not a bug in pangolin per say, simply this is how traefik the underlying webserver for pangolin currently handles this for http challenges. The workaround as by traefik standards is to manually prune your acme.json or there are some tools on github that the community have made but use at own risk.
I switched to DNS Challenge recently and purged my acme.json. Only pangolin.exmaple.com and wildcard *.example.com now exist. But searching the web (specific sub.domain finder) all my previous, also long.time ago removed subdomains, are still found.
Is there anything else to be purged, reset or deleted ?
<!-- gh-comment-id:3938776062 -->
@DannyBoyKN commented on GitHub (Feb 21, 2026):
I switched to DNS Challenge recently and purged my acme.json. Only pangolin.exmaple.com and wildcard *.example.com now exist. But searching the web (specific sub.domain finder) all my previous, also long.time ago removed subdomains, are still found.
Is there anything else to be purged, reset or deleted ?
@LaurenceJJones commented on GitHub (Feb 22, 2026):
Nope, deleting that is all you can do. The reason sites like https://crt.sh still have the information is due to certificate transparency standards which is a interesting read on why its a good thing to have when we didnt have such standards.
<!-- gh-comment-id:3940299793 -->
@LaurenceJJones commented on GitHub (Feb 22, 2026):
Nope, deleting that is all you can do. The reason sites like https://crt.sh still have the information is due to certificate transparency standards which is a interesting read on why its a good thing to have when we didnt have such standards.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @eldridgea on GitHub (Jan 30, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2382
Describe the Bug
When I delete a public resource from Pangolin, Pangolin still requests certificates for that subdomain. I regularly get certificate transparency reports for certificates issued from Lets Encrypt to subdomains that I used to have as a resource in pangolin and have since been deleted.
Environment
To Reproduce
Expected Behavior
Certificate issuance and renewals are only requested for subdomains connected to existing resources.
@AstralDestiny commented on GitHub (Feb 2, 2026):
Using http validation method I assume? If so that's intended traefik stuff.. Check your acme.json file
@github-actions[bot] commented on GitHub (Feb 17, 2026):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@LaurenceJJones commented on GitHub (Feb 19, 2026):
Not a bug in pangolin per say, simply this is how traefik the underlying webserver for pangolin currently handles this for http challenges. The workaround as by traefik standards is to manually prune your acme.json or there are some tools on github that the community have made but use at own risk.
@DannyBoyKN commented on GitHub (Feb 21, 2026):
I switched to DNS Challenge recently and purged my acme.json. Only pangolin.exmaple.com and wildcard *.example.com now exist. But searching the web (specific sub.domain finder) all my previous, also long.time ago removed subdomains, are still found.
Is there anything else to be purged, reset or deleted ?
@LaurenceJJones commented on GitHub (Feb 22, 2026):
Nope, deleting that is all you can do. The reason sites like https://crt.sh still have the information is due to certificate transparency standards which is a interesting read on why its a good thing to have when we didnt have such standards.