Originally assigned to: @oschwartz10612 on GitHub.
Hi,
I'm trying to configure Wildcard Config for DNS-01 Challenge but I keep having the same error despite all of my attemps :
{"level":"error","providerName":"letsencrypt.acme","acmeCA":"https://acme-v02.api.letsencrypt.org/directory","providerName":"letsencrypt.acme","ACME CA":"https://acme-v02.api.letsencrypt.org/directory","routerName":"next-router@file","rule":"Host(domain.com) && !PathPrefix(/api/v1)","error":"cannot get ACME client cloudflare: some credentials information are missing: CLOUDFLARE_EMAIL,CLOUDFLARE_API_KEY or some credentials information are missing: CLOUDFLARE_DNS_API_TOKEN,CLOUDFLARE_ZONE_API_TOKEN","domains":["domain.com","*.domain.com"],"time":"2025-05-04T17:56:58Z","message":"Unable to obtain ACME certificate for domains"}
Originally created by @3ct0pl4sm on GitHub (May 4, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/670
Originally assigned to: @oschwartz10612 on GitHub.
Hi,
I'm trying to configure Wildcard Config for DNS-01 Challenge but I keep having the same error despite all of my attemps :
> {"level":"error","providerName":"letsencrypt.acme","acmeCA":"https://acme-v02.api.letsencrypt.org/directory","providerName":"letsencrypt.acme","ACME CA":"https://acme-v02.api.letsencrypt.org/directory","routerName":"next-router@file","rule":"Host(`domain.com`) && !PathPrefix(`/api/v1`)","error":"cannot get ACME client cloudflare: some credentials information are missing: CLOUDFLARE_EMAIL,CLOUDFLARE_API_KEY or some credentials information are missing: CLOUDFLARE_DNS_API_TOKEN,CLOUDFLARE_ZONE_API_TOKEN","domains":["domain.com","*.domain.com"],"time":"2025-05-04T17:56:58Z","message":"Unable to obtain ACME certificate for domains"}
Cloudflare API Key is mentionned in docker-compose.yml as it is here :
[https://docs.fossorial.io/Pangolin/Configuration/wildcard-certs#wildcard-config-for-dns-01-challenge](url)
this way :
```
traefik:
image: traefik:v3.3.6
container_name: traefik
restart: unless-stopped
network_mode: service:gerbil
depends_on:
pangolin:
condition: service_healthy
command:
- --configFile=/etc/traefik/traefik_config.yml
environment:
CLOUDFLARE_DNS_API_TOKEN: "token"
volumes:
- ./config/traefik:/etc/traefik:ro
- ./config/letsencrypt:/letsencrypt
```
Can someone help me ?
Are you using the in-built Traefik deployment, or an existing Traefik deployment?
<!-- gh-comment-id:2849361957 -->
@boomam commented on GitHub (May 4, 2025):
Are you using the in-built Traefik deployment, or an existing Traefik deployment?
Are you using the in-built Traefik deployment, or an existing Traefik deployment?
I'm using the built-in deployment.
I was restarting wrong the stack, I've figured it out, but now i've this error :
cloudflare: failed to create TXT record
<!-- gh-comment-id:2849362925 -->
@3ct0pl4sm commented on GitHub (May 4, 2025):
> Are you using the in-built Traefik deployment, or an existing Traefik deployment?
I'm using the built-in deployment.
I was restarting wrong the stack, I've figured it out, but now i've this error :
`cloudflare: failed to create TXT record`
I managed to make it work. Thanks for your time and your answers.
Struggling with this - how did you make it work?
<!-- gh-comment-id:2860490896 -->
@thimplicity commented on GitHub (May 7, 2025):
> I managed to make it work. Thanks for your time and your answers.
Struggling with this - how did you make it work?
I managed to make it work. Thanks for your time and your answers.
Struggling with this - how did you make it work?
You need to set your traefik config to use DNS for its certificate challenge type.
Edit your Traefik configuration or your Traefik labels to use DNS challenge instead of the default HTTP challenge.
<!-- gh-comment-id:2860975019 -->
@boomam commented on GitHub (May 8, 2025):
> > I managed to make it work. Thanks for your time and your answers.
>
> Struggling with this - how did you make it work?
You need to set your traefik config to use DNS for its certificate challenge type.
Edit your Traefik configuration or your Traefik labels to use [DNS challenge](https://doc.traefik.io/traefik/https/acme/#dnschallenge) instead of the default HTTP challenge.
Pangolin has some ok docs on the process [here](https://docs.fossorial.io/Pangolin/Configuration/wildcard-certs#wildcard-config-for-dns-01-challenge)
I have a problem with the Pangolin docs around this. The docs have the base domain in the next-router rule. However, the installer puts the pangolin web frontend subdomain in the next-router. This discrepancy leads to confusion. Just going with the docs, adding the domains to the tls subsection leads to errors (404 on the frontend after restarting the stack).
<!-- gh-comment-id:2893298170 -->
@HWiese1980 commented on GitHub (May 20, 2025):
I have a problem with the Pangolin docs around this. The docs have the base domain in the next-router rule. However, the installer puts the pangolin web frontend subdomain in the next-router. This discrepancy leads to confusion. Just going with the docs, adding the domains to the `tls` subsection leads to errors (404 on the frontend after restarting the stack).
Maybe someone could resolve this discrepancy? That would be awesome. I have my troubles figuring it out.
<!-- gh-comment-id:2894177429 -->
@HWiese1980 commented on GitHub (May 20, 2025):
Maybe someone could resolve this discrepancy? That would be awesome. I have my troubles figuring it out.
@github-actions[bot] commented on GitHub (Jun 4, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
<!-- gh-comment-id:2937857981 -->
@github-actions[bot] commented on GitHub (Jun 4, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
Has anyone already looked into it? The documentation seems to be off here.
<!-- gh-comment-id:2938645652 -->
@HWiese1980 commented on GitHub (Jun 4, 2025):
Has anyone already looked into it? The documentation seems to be off here.
@HWiese1980 @thimplicity So something that I add to the certificatesResolvers section to make sure to add DNS resolvers that point to ones outside of my infrastructure. For some reason especially when running in docker traefik will mess up and fail to complete the certificate creation/renewal process if doing DNS-01 and it resolves against the docker inbuilt resolver. So basically my certificatesResolvers section looks something like:
<!-- gh-comment-id:2971954125 -->
@mort666 commented on GitHub (Jun 13, 2025):
@HWiese1980 @thimplicity So something that I add to the certificatesResolvers section to make sure to add DNS resolvers that point to ones outside of my infrastructure. For some reason especially when running in docker traefik will mess up and fail to complete the certificate creation/renewal process if doing DNS-01 and it resolves against the docker inbuilt resolver. So basically my certificatesResolvers section looks something like:
```yaml
certificatesResolvers:
letsencrypt:
acme:
email: hostmaster@example,com
storage: /letsencrypt/acme.json
caServer: https://acme-v02.api.letsencrypt.org/directory
dnsChallenge:
provider: cloudflare
delayBeforeCheck: 0
resolvers:
- 1.1.1.1:53
- 8.8.8.8:53
```
Related: For those who need wildcard routing (not just wildcard certs), see #959 where I documented a working workaround for *.git-pages.com → GitLab Pages through Pangolin.
The wildcard cert DNS-01 challenge itself works fine in Traefik — the missing piece is that Pangolin doesn't support wildcard domains as resources. The workaround is a manual Traefik rule file with HostRegexp that references the Pangolin-managed service ID.
The locked #139 ("Support Secondary Reverse Proxy") and the deleted wildcard-resource branch suggest this was on the roadmap at some point but stalled.
<!-- gh-comment-id:4109194981 -->
@strausmann commented on GitHub (Mar 23, 2026):
Related: For those who need wildcard *routing* (not just wildcard certs), see #959 where I documented a working workaround for `*.git-pages.com` → GitLab Pages through Pangolin.
The wildcard cert DNS-01 challenge itself works fine in Traefik — the missing piece is that Pangolin doesn't support wildcard domains as resources. The workaround is a manual Traefik rule file with `HostRegexp` that references the Pangolin-managed service ID.
The locked #139 ("Support Secondary Reverse Proxy") and the deleted `wildcard-resource` branch suggest this was on the roadmap at some point but stalled.
@LaurenceJJones commented on GitHub (Apr 14, 2026):
Closing as completed due to OP finding a resolution to the specific topic was opened for.
<!-- gh-comment-id:4245637481 -->
@LaurenceJJones commented on GitHub (Apr 14, 2026):
Closing as completed due to OP finding a resolution to the specific topic was opened for.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @3ct0pl4sm on GitHub (May 4, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/670
Originally assigned to: @oschwartz10612 on GitHub.
Hi,
I'm trying to configure Wildcard Config for DNS-01 Challenge but I keep having the same error despite all of my attemps :
Cloudflare API Key is mentionned in docker-compose.yml as it is here :
https://docs.fossorial.io/Pangolin/Configuration/wildcard-certs#wildcard-config-for-dns-01-challenge
this way :
Can someone help me ?
@boomam commented on GitHub (May 4, 2025):
Are you using the in-built Traefik deployment, or an existing Traefik deployment?
@3ct0pl4sm commented on GitHub (May 4, 2025):
I'm using the built-in deployment.
I was restarting wrong the stack, I've figured it out, but now i've this error :
cloudflare: failed to create TXT record@3ct0pl4sm commented on GitHub (May 4, 2025):
I managed to make it work.
Thanks for your time and your answers.
@thimplicity commented on GitHub (May 7, 2025):
Struggling with this - how did you make it work?
@boomam commented on GitHub (May 8, 2025):
You need to set your traefik config to use DNS for its certificate challenge type.
Edit your Traefik configuration or your Traefik labels to use DNS challenge instead of the default HTTP challenge.
Pangolin has some ok docs on the process here
@HWiese1980 commented on GitHub (May 20, 2025):
I have a problem with the Pangolin docs around this. The docs have the base domain in the next-router rule. However, the installer puts the pangolin web frontend subdomain in the next-router. This discrepancy leads to confusion. Just going with the docs, adding the domains to the
tlssubsection leads to errors (404 on the frontend after restarting the stack).@HWiese1980 commented on GitHub (May 20, 2025):
Maybe someone could resolve this discrepancy? That would be awesome. I have my troubles figuring it out.
@github-actions[bot] commented on GitHub (Jun 4, 2025):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@HWiese1980 commented on GitHub (Jun 4, 2025):
Has anyone already looked into it? The documentation seems to be off here.
@mort666 commented on GitHub (Jun 13, 2025):
@HWiese1980 @thimplicity So something that I add to the certificatesResolvers section to make sure to add DNS resolvers that point to ones outside of my infrastructure. For some reason especially when running in docker traefik will mess up and fail to complete the certificate creation/renewal process if doing DNS-01 and it resolves against the docker inbuilt resolver. So basically my certificatesResolvers section looks something like:
@strausmann commented on GitHub (Mar 23, 2026):
Related: For those who need wildcard routing (not just wildcard certs), see #959 where I documented a working workaround for
*.git-pages.com→ GitLab Pages through Pangolin.The wildcard cert DNS-01 challenge itself works fine in Traefik — the missing piece is that Pangolin doesn't support wildcard domains as resources. The workaround is a manual Traefik rule file with
HostRegexpthat references the Pangolin-managed service ID.The locked #139 ("Support Secondary Reverse Proxy") and the deleted
wildcard-resourcebranch suggest this was on the roadmap at some point but stalled.@LaurenceJJones commented on GitHub (Apr 14, 2026):
Closing as completed due to OP finding a resolution to the specific topic was opened for.