mirror of
https://github.com/fosrl/pangolin.git
synced 2026-05-06 12:55:03 -05:00
[GH-ISSUE #2382] Pangolin requests certificates for domains of deleted resources #6957
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/pangolin#6957
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @eldridgea on GitHub (Jan 30, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2382
Describe the Bug
When I delete a public resource from Pangolin, Pangolin still requests certificates for that subdomain. I regularly get certificate transparency reports for certificates issued from Lets Encrypt to subdomains that I used to have as a resource in pangolin and have since been deleted.
Environment
To Reproduce
Expected Behavior
Certificate issuance and renewals are only requested for subdomains connected to existing resources.
@AstralDestiny commented on GitHub (Feb 2, 2026):
Using http validation method I assume? If so that's intended traefik stuff.. Check your acme.json file
@github-actions[bot] commented on GitHub (Feb 17, 2026):
This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
@LaurenceJJones commented on GitHub (Feb 19, 2026):
Not a bug in pangolin per say, simply this is how traefik the underlying webserver for pangolin currently handles this for http challenges. The workaround as by traefik standards is to manually prune your acme.json or there are some tools on github that the community have made but use at own risk.
@DannyBoyKN commented on GitHub (Feb 21, 2026):
I switched to DNS Challenge recently and purged my acme.json. Only pangolin.exmaple.com and wildcard *.example.com now exist. But searching the web (specific sub.domain finder) all my previous, also long.time ago removed subdomains, are still found.
Is there anything else to be purged, reset or deleted ?
@LaurenceJJones commented on GitHub (Feb 22, 2026):
Nope, deleting that is all you can do. The reason sites like https://crt.sh still have the information is due to certificate transparency standards which is a interesting read on why its a good thing to have when we didnt have such standards.