github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-07 21:30:36 -05:00
Code Issues 564 Packages Projects Releases 72 Wiki Activity

[GH-ISSUE #464] Wildcard Certs in Multiple Domains #1469

New Issue
Closed
opened 2026-04-16 08:07:18 -05:00 by GiteaMirror · 5 comments
GiteaMirror commented 2026-04-16 08:07:18 -05:00
Owner
Copy Link

Originally created by @Tanhueco on GitHub (Apr 5, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/464

I tried this out but the website does not come up. Is it possible to have wildcard certificates issued to mutiple domains?

dynamic_config.yml:

next-router:
   entryPoints:
     - websecure
   middlewares:
     - security-headers
   rule: Host(`proxy.domain1.com`) && !PathPrefix(`/api/v1`)
   service: next-service
   tls:
     certResolver: letsencrypt
     domains[0]:
       - main: "domain1.com"
         sans:
           - "*.domain1.com"
     domains[1]:
       - main: "domain2.com"
         sans:
           - "*.domain2.com"

A single domain works ok:

next-router:
   entryPoints:
     - websecure
   middlewares:
     - security-headers
   rule: Host(`proxy.domain1.com`) && !PathPrefix(`/api/v1`)
   service: next-service
   tls:
     certResolver: letsencrypt
     domains:
       - main: "domain1.com"
         sans:
           - "*.domain1.com"
Originally created by @Tanhueco on GitHub (Apr 5, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/464 I tried this out but the website does not come up. Is it possible to have wildcard certificates issued to mutiple domains? dynamic_config.yml: next-router: entryPoints: - websecure middlewares: - security-headers rule: Host(`proxy.domain1.com`) && !PathPrefix(`/api/v1`) service: next-service tls: certResolver: letsencrypt domains[0]: - main: "domain1.com" sans: - "*.domain1.com" domains[1]: - main: "domain2.com" sans: - "*.domain2.com" A single domain works ok: next-router: entryPoints: - websecure middlewares: - security-headers rule: Host(`proxy.domain1.com`) && !PathPrefix(`/api/v1`) service: next-service tls: certResolver: letsencrypt domains: - main: "domain1.com" sans: - "*.domain1.com"
GiteaMirror commented 2026-04-16 08:07:20 -05:00
Author
Owner
Copy Link

@Lokowitz commented on GitHub (Apr 5, 2025):

Hi Tanhueco,

when i remember correct it should work like this:

     domains:
       - main: "domain1.com"
         sans:
           - "*.domain1.com"
       - main: "domain2.com"
         sans:
           - "*.domain2.com"

Are you using the same provider for all domains?

<!-- gh-comment-id:2780920467 --> @Lokowitz commented on GitHub (Apr 5, 2025): Hi Tanhueco, when i remember correct it should work like this: ``` domains: - main: "domain1.com" sans: - "*.domain1.com" - main: "domain2.com" sans: - "*.domain2.com" ``` Are you using the same provider for all domains?
GiteaMirror commented 2026-04-16 08:07:20 -05:00
Author
Owner
Copy Link

@Tanhueco commented on GitHub (Apr 5, 2025):

@Lokowitz, That works!

Yes, all domains are from the same provider.

<!-- gh-comment-id:2780960653 --> @Tanhueco commented on GitHub (Apr 5, 2025): @Lokowitz, That works! Yes, all domains are from the same provider.
GiteaMirror commented 2026-04-16 08:07:21 -05:00
Author
Owner
Copy Link

@miloschwartz commented on GitHub (Apr 11, 2025):

Thanks @Lokowitz!

<!-- gh-comment-id:2795651769 --> @miloschwartz commented on GitHub (Apr 11, 2025): Thanks @Lokowitz!
GiteaMirror commented 2026-04-16 08:07:21 -05:00
Author
Owner
Copy Link

@nlsrchtr commented on GitHub (Aug 8, 2025):

Hi @Lokowitz,

could you help me out, when I have multiple wildcard domains with different providers? How would I adjust the certificatesResolvers in a way, that it would pick up the correct configuration per domain?

certificatesResolvers:
  letsencrypt:
    acme:
      httpChallenge:
        entryPoint: web
      email: hello@example.com # REPLACE THIS WITH YOUR EMAIL
      storage: "/letsencrypt/acme.json"
      caServer: "https://acme-v02.api.letsencrypt.org/directory"

Thanks a lot for your help or any pointers!

Regards,

<!-- gh-comment-id:3169399340 --> @nlsrchtr commented on GitHub (Aug 8, 2025): Hi @Lokowitz, could you help me out, when I have multiple wildcard domains with different providers? How would I adjust the certificatesResolvers in a way, that it would pick up the correct configuration per domain? ```yaml certificatesResolvers: letsencrypt: acme: httpChallenge: entryPoint: web email: hello@example.com # REPLACE THIS WITH YOUR EMAIL storage: "/letsencrypt/acme.json" caServer: "https://acme-v02.api.letsencrypt.org/directory" ``` Thanks a lot for your help or any pointers! Regards,
GiteaMirror commented 2026-04-16 08:07:22 -05:00
Author
Owner
Copy Link

@Lokowitz commented on GitHub (Aug 9, 2025):

Hi @nlsrchtr
according to the traefik docs, it is not supported. But there is a workaround:

Multiple DNS challenge provider are not supported with Traefik, but you can use CNAME to handle that. For example, if you have example.org (account foo) and example.com (account bar) you can create a CNAME on example.org called _acme-challenge.example.org pointing to challenge.example.com. This way, you can obtain certificates for example.org with the bar account.

<!-- gh-comment-id:3170467007 --> @Lokowitz commented on GitHub (Aug 9, 2025): Hi @nlsrchtr according to the traefik [docs](https://doc.traefik.io/traefik/https/acme/#dnschallenge), it is not supported. But there is a workaround: > Multiple DNS challenge provider are not supported with Traefik, but you can use CNAME to handle that. For example, if you have example.org (account foo) and example.com (account bar) you can create a CNAME on example.org called _acme-challenge.example.org pointing to challenge.example.com. This way, you can obtain certificates for example.org with the bar account.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#1469
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?