Acme certificate requested on all TLS-Aware entrypoints

[isrjo]

What version of Traefik are you using (traefik version)?

traefik:latest

Running traefik in a container with swarm as backend with the follwing acme configuration

--entryPoints="Name:acme Address::445 TLS" --acme --acme.email='[email protected]' --acme.entrypoint='acme' --acme.ondemand --acme.onhostrule --acme.storage=/etc/traefik/acme/acme.json --accesslogsfile=/log/access_log --acme.acmelogging

What did you do?

I have several TLS-aware Entrypoints defined in my traefik configuration.
I've noticed every container I start regardless of TLS entrypoint used result in a acme certificate request.
Is this really the expected behavior ?

What did you expect to see?

Certificates requested only for containers using the entrypoint correlating to the one used for acme challenge --acme.entrypoint='acme'

[emilevauge]

@isrjo ouch, thanks for reporting.
There is indeed an issue here, we should also check that the frontend is linked to the ACME entrypoint... Will push a fix ASAP.

[isrjo]

Perhaps off topic (I would gladly open an enhancement request if confirmed) While at it. I know little or nothing about go, but by reading code I'm under the impression --acme.entrypoint is single value, and if right I wonder why? Would not a multivalue be more appropriate, allowing multiple entrypoints to become acme aware?

[tcolgate]

We have two https entrypoints which serve https on two different ports (these are then accessed by two different LB, each of which has different access rules, one for public services, one for private). We would like to use LE certs for both. Since one of these is private, we are using route53 dns for provisioning.
I'd be happy for acme.entrypoint to take a list, but, equally, I don't need to for https SNI challenges at all.

[emilevauge]

Fixed by #1401