Wildcard Certificates Not Being Generated Despite prefer_wildcard_cert: true #766

New Issue

2025-11-13T12:10:21-06:00

GiteaMirror commented

2025-11-13 12:10:21 -06:00

Originally created by @AndrewPaglusch on GitHub (Nov 8, 2025).

Originally assigned to: @oschwartz10612 on GitHub.

Describe the Bug

Possibly related to #1816

When prefer_wildcard_cert: true is set in config.yaml for domains, Traefik still generates individual certificates for each subdomain instead of requesting wildcard certificates.

 domains:
   domain1:
     base_domain: foobar1.com
     cert_resolver: letsencrypt
     prefer_wildcard_cert: true
   domain2:
     base_domain: foobar2.com
     cert_resolver: letsencrypt
     prefer_wildcard_cert: true

I believe this bug was introduced in commit https://github.com/fosrl/pangolin/commit/d938345debe8a515a8d251cdf4bd448e75ef811e on Wed Oct 8, since there seems to be some changes being made around the preferWildcardCert setting there.

Environment

OS Type & Version: AlmaLinux 9.6
Pangolin Version: 1.12.1 (Community)
Gerbil Version: 1.2.2
Traefik Version: 3.4.0
Newt Version: 1.6.0
Olm Version: N/A

To Reproduce

Configure domains in config.yaml with prefer_wildcard_cert: true:

domains:
  domain1:
    base_domain: foobar1.com
    cert_resolver: letsencrypt
    prefer_wildcard_cert: true
  domain2:
    base_domain: foobar2.com
    cert_resolver: letsencrypt
    prefer_wildcard_cert: true

Set global preference in config.yaml:

traefik:
  cert_resolver: letsencrypt
  prefer_wildcard_cert: true

Clear the acme.json file to force certificate regeneration:
```
rm /path/to/letsencrypt/acme.json
```
Restart Pangolin and observe the Traefik logs and/or look at certs generated.

Expected Behavior

The Traefik dynamic configuration should include wildcard domain specifications like:

{
  "tls": {
    "certResolver": "letsencrypt",
    "domains": [
      {
        "main": "*.foobar1.com"
      }
    ]
  }
}

This would cause Traefik to request a single wildcard certificate covering all subdomains.

The Traefik dynamic configuration generates individual domain entries instead:

$ curl -s http://localhost:3001/api/v1/traefik-config | jq '.http.routers | to_entries | .[0] | {router: .key, tls_domains: .value.tls.domains}'
{
  "router": "605-prefix-cloud-foobar1-com-router",
  "tls_domains": [
    {
      "main": "cloud.foobar1.com"
    }
  ]
}

Every subdomain gets its own specific certificate request instead of using wildcards.

Originally created by @AndrewPaglusch on GitHub (Nov 8, 2025). Originally assigned to: @oschwartz10612 on GitHub. ### Describe the Bug Possibly related to [#1816](https://github.com/fosrl/pangolin/issues/1816) When `prefer_wildcard_cert: true` is set in `config.yaml` for domains, Traefik still generates individual certificates for each subdomain instead of requesting wildcard certificates. ```yaml domains: domain1: base_domain: foobar1.com cert_resolver: letsencrypt prefer_wildcard_cert: true domain2: base_domain: foobar2.com cert_resolver: letsencrypt prefer_wildcard_cert: true ``` I believe this bug was introduced in commit https://github.com/fosrl/pangolin/commit/d938345debe8a515a8d251cdf4bd448e75ef811e on Wed Oct 8, since there seems to be some changes being made around the `preferWildcardCert` setting there. ### Environment - OS Type & Version: AlmaLinux 9.6 - Pangolin Version: 1.12.1 (Community) - Gerbil Version: 1.2.2 - Traefik Version: 3.4.0 - Newt Version: 1.6.0 - Olm Version: N/A ### To Reproduce 1. Configure domains in `config.yaml` with `prefer_wildcard_cert: true`: ```yaml domains: domain1: base_domain: foobar1.com cert_resolver: letsencrypt prefer_wildcard_cert: true domain2: base_domain: foobar2.com cert_resolver: letsencrypt prefer_wildcard_cert: true ``` 2. Set global preference in `config.yaml`: ```yaml traefik: cert_resolver: letsencrypt prefer_wildcard_cert: true ``` 3. Clear the `acme.json` file to force certificate regeneration: ```bash rm /path/to/letsencrypt/acme.json ``` 4. Restart Pangolin and observe the Traefik logs and/or look at certs generated. ### Expected Behavior The Traefik dynamic configuration should include wildcard domain specifications like: ```json { "tls": { "certResolver": "letsencrypt", "domains": [ { "main": "*.foobar1.com" } ] } } ``` This would cause Traefik to request a single wildcard certificate covering all subdomains. The Traefik dynamic configuration generates individual domain entries instead: ```bash $ curl -s http://localhost:3001/api/v1/traefik-config | jq '.http.routers | to_entries | .[0] | {router: .key, tls_domains: .value.tls.domains}' { "router": "605-prefix-cloud-foobar1-com-router", "tls_domains": [ { "main": "cloud.foobar1.com" } ] } ``` Every subdomain gets its own specific certificate request instead of using wildcards.

GiteaMirror added the bug label 2025-11-13 12:10:21 -06:00

GiteaMirror commented

2025-11-13 12:10:22 -06:00

@AndrewPaglusch commented on GitHub (Nov 9, 2025):

This bug still appears to be present in the latest release 1.12.2.

[root@cloud-dmz:/opt/docker/pangolin]# docker exec -it pangolin curl -s http://localhost:3001/api/v1/traefik-config | jq '.http.routers | to_entries | .[0] | {router: .key, tls_domains: .value.tls.domains}'
{
  "router": "605-prefix-cloud-foobar1-com-router",
  "tls_domains": [
    {
      "main": "cloud.foobar1.com"
    }
  ]
}

I can see individual certs still being generated:

jq '.letsencrypt.Certificates[].domain' < /opt/docker/pangolin/config/letsencrypt/acme.json
{
  "main": "plex.foobar1.com"
}
{
  "main": "photos.foobar2.com"
}
{
  "main": "cloud.foobar3.net"
}
[...]

@oschwartz10612 Would you mind re-opening this issue if you can confirm it's still a problem?

@AndrewPaglusch commented on GitHub (Nov 9, 2025): This bug still appears to be present in the latest release 1.12.2. ``` [root@cloud-dmz:/opt/docker/pangolin]# docker exec -it pangolin curl -s http://localhost:3001/api/v1/traefik-config | jq '.http.routers | to_entries | .[0] | {router: .key, tls_domains: .value.tls.domains}' { "router": "605-prefix-cloud-foobar1-com-router", "tls_domains": [ { "main": "cloud.foobar1.com" } ] } ``` I can see individual certs still being generated: ``` jq '.letsencrypt.Certificates[].domain' < /opt/docker/pangolin/config/letsencrypt/acme.json { "main": "plex.foobar1.com" } { "main": "photos.foobar2.com" } { "main": "cloud.foobar3.net" } [...] ``` @oschwartz10612 Would you mind re-opening this issue if you can confirm it's still a problem?

GiteaMirror commented

2025-11-13 12:10:22 -06:00

@Anmol202005 commented on GitHub (Nov 10, 2025):

@AndrewPaglusch tried reproducing works good :


~ ❯ curl -s http://localhost:3001/api/v1/traefik-config | jq '.http.routers | to_entries[] | select(.value.tls != null) | {router: .key, tls: .value.tls}'
{
  "router": "2-api-router",
  "tls": {
    "certResolver": "letsencrypt",
    "domains": [
      {
        "main": "*.foobar1.com"
      }
    ]
  }
}
{
  "router": "3-dashboard-router",
  "tls": {
    "certResolver": "letsencrypt",
    "domains": [
      {
        "main": "*.foobar1.com"
      }
    ]
  }
}

@Anmol202005 commented on GitHub (Nov 10, 2025): @AndrewPaglusch tried reproducing works good : ```bash ~ ❯ curl -s http://localhost:3001/api/v1/traefik-config | jq '.http.routers | to_entries[] | select(.value.tls != null) | {router: .key, tls: .value.tls}' { "router": "2-api-router", "tls": { "certResolver": "letsencrypt", "domains": [ { "main": "*.foobar1.com" } ] } } { "router": "3-dashboard-router", "tls": { "certResolver": "letsencrypt", "domains": [ { "main": "*.foobar1.com" } ] } } ```

GiteaMirror commented

2025-11-13 12:10:22 -06:00

@AndrewPaglusch commented on GitHub (Nov 11, 2025):

@Anmol202005 Would you mind sharing your redacted config with me? I'd like to see if you're configuring wildcard domains differently than I am. Thanks!

In your redacted output above, I noticed you have two wildcard domains returned for the same (fake) domain. In your real output, are there two different wildcards being returned, each for different domains, or are they each for the same domain?

@AndrewPaglusch commented on GitHub (Nov 11, 2025): @Anmol202005 Would you mind sharing your redacted config with me? I'd like to see if you're configuring wildcard domains differently than I am. Thanks! In your redacted output above, I noticed you have two wildcard domains returned for the same (fake) domain. In your _real_ output, are there two different wildcards being returned, each for different domains, or are they each for the same domain?

Wildcard Certificates Not Being Generated Despite prefer_wildcard_cert: true #766

Describe the Bug

Environment

To Reproduce

Expected Behavior

Wildcard Certificates Not Being Generated Despite `prefer_wildcard_cert: true` #766