Wildcard domain certificate generation with route 53 fails. #3957
Assignees
Labels
area/acme
kind/bug/possible
a possible bug that needs analysis before it is confirmed or fixed.
priority/P1
need to be fixed in next release
status/5-frozen-due-to-age
Milestone
Comments
|
@gurumark Issue templates help us help you by providing all necessary information. Please edit your issue and use the available template: |
ldez
changed the title
nmengin
added
priority/P1
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
I'm also experiencing this, so: adding logs to the logs party
Normal Log Error: Docker Compose YAML:version: "3"
services:
traefik:
image: "traefik:1.7.0-rc5"
command:
- "--web"
- "--logLevel=DEBUG"
- "--entrypoints=Name:http Address::80 Redirect.EntryPoint:https"
- "--entrypoints=Name:https Address::443 TLS"
- "--defaultentrypoints=http,https"
- "--acme"
- "--acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
- "[email protected]"
- "--acme.storage=/etc/traefik/acme/acme.json"
- "--acme.entrypoint=https"
- "--acme.dnschallenge"
- "--acme.dnschallenge.provider=route53"
- "--acme.domains=*.jericdeleon-cluster01.com,jericdeleon-cluster01.com"
- "--docker"
- "--docker.domain=jericdeleon-cluster01.com"
- "--docker.swarmmode"
- "--docker.watch"
deploy:
labels:
- "traefik.docker.network=docker-control-plane-local_docker-control-network"
- "traefik.entrypoints=https"
- "traefik.frontend.rule=Host:jericdeleon-cluster01.com"
- "traefik.port=8080"
placement:
constraints:
- node.role == manager
resources:
limits:
memory: 100m
reservations:
memory: 100m
restart_policy:
condition: on-failure
delay: 1m
max_attempts: 3
window: 1m
environment:
AWS_ACCESS_KEY_ID: "XXXXXXXXXXXXXXXXXXX"
AWS_SECRET_ACCESS_KEY: "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
AWS_REGION: "us-west-1"
AWS_HOSTED_ZONE_ID: "XXXXXXXXXXXXXX"
logging:
driver: "json-file"
options:
max-size: "50m"
max-file: "4"
ports:
- "80:80"
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /dev/null:/traefik.toml
- ./traefik/acme.json:/etc/traefik/acme/acme.json
networks:
- docker-control-network
portainer:
image: "portainer/portainer:1.19.2"
command: --admin-password "$$2y$$05$$/73YA6gjAnWmMhvBg8PWAeJtGwYrRm07qQL6dU9zb1STd051yU6Ia" -H unix:///var/run/docker.sock
deploy:
labels:
- "traefik.docker.network=docker-control-plane-local_docker-control-network"
- "traefik.entrypoints=https"
- "traefik.frontend.rule=Host:portainer.jericdeleon-cluster01.com"
- "traefik.port=9000"
placement:
constraints:
- node.role == manager
resources:
limits:
memory: 150m
reservations:
memory: 100m
restart_policy:
condition: on-failure
delay: 1m
max_attempts: 3
window: 1m
logging:
driver: "json-file"
options:
max-size: "50m"
max-file: "4"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- portainer-data:/data
networks:
- docker-control-network
networks:
docker-control-network:
external:
name: docker-control-plane-local_docker-control-network
volumes:
portainer-data:Traefik Debug Logs:Also noticed that on Route53 side, TXT value for
Until this issue is resolved, are there any other ways to use [wildcard + root domain] certs with LE? |
|
Wildcard certificates are only available with the DNS challenge. I'm working on it and I'll need some testers ... I'll post a message here when my patch is ready to be tested. |
|
@ldez I am ready to test if needed. |
|
I'm just confirming this is an issue in 1.7.1 (wildcard + root). For now I'm limping along without the root sans. Happy to test as well. |
This comment has been minimized.
This comment has been minimized.
|
@gurumark @jericdeleon @ShakataGaNai could you test with Please enable the logs as follows: # traefik.toml
logLevel = "DEBUG"
# ...
[acme]
# ...
acmeLogging = true
# ... |
|
Where is this image - ldez/traefik:route53 - located? |
This comment has been minimized.
This comment has been minimized.
|
@gurumark Traefik doesn't based the redirection on certificates. You cannot revoke manually a certificate with Træfik. Please keep focus on the main goal of the issue: Wildcard domain certificate generation. Did you use my custom version? Wildcard domains work? I will consider the issue as solved if the following case works: [[acme.domains]]
main = "*.example.com"
sans = ["example.com"]https://docs.traefik.io/configuration/acme/#wildcard-domains |
|
@ldez Thanks for the information. I don't believe it's redirecting since it does not have any rules to do so. Most possible answer is it is serving the wrong certificate. But I deleted the container including the volumes and created a new one. It did the same. I tried a different browser to eliminate caching. It did not work either. Well, I have a certificate file not based on wildcard and it is working now. I want to test the whole thing correctly. |
|
Yes you have to remove the I recommend to use the Let's Encrypt staging (https://docs.traefik.io/configuration/acme/#caserver) to avoid LE rate limits during your tests: [acme]
# ...
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
# ...Note that the staging serves as fakes certificates. |
|
Here are the results of my test: Using your image:(ldez/traefik:route53) Traefik could not access to the zone and create the _acme-challenge. TXT. Switching back to traefik:alpine Using the traefik:alpine was again able to create _acme-challenge.example.com in route 53 but eventually timed out. I used the same configuration for both tests. |
|
You have to update your policies: {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Action": [
"route53:GetChange",
"route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets"
],
"Resource": [
"arn:aws:route53:::hostedzone/*",
"arn:aws:route53:::change/*"
]
},
{
"Sid": "",
"Effect": "Allow",
"Action": "route53:ListHostedZonesByName",
"Resource": "*"
}
]
}I updated the image. Could you pull again the image and retry? |
|
That hit the spot! I was able to generate a valid
Route53 Policy:{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Action": [
"route53:ListResourceRecordSets",
"route53:ChangeResourceRecordSets",
"route53:GetChange",
"route53:GetChangeDetails",
"route53:ListHostedZones",
"route53:ListHostedZonesByName"
],
"Resource": [
"*"
]
}
]
}acme.json:{
"Account": {
"Email": "[email protected]",
"Registration": {
"body": {
"status": "valid",
"contact": [
"mailto:[email protected]"
]
},
"uri": "https://acme-staging-v02.api.letsencrypt.org/acme/acct/7090793"
},
"PrivateKey": "xxx",
"KeyType": "4096"
},
"Certificates": [
{
"Domain": {
"Main": "*.jericdeleon-cluster01.com",
"SANs": [
"jericdeleon-cluster01.com"
]
},
"Certificate": "xxx",
"Key": "xxx"
}
],
"HTTPChallenges": {},
"TLSChallenges": {}
}Traefik / ACME Debug Logs:Looking back on it: Previous Route53 Policy:{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Action": [
"route53:ChangeResourceRecordSets",
"route53:GetChange",
"route53:GetChangeDetails",
"route53:ListHostedZones",
],
"Resource": [
"*"
]
}
]
}Is anyone else also seeing success? |
|
Yes, I am able to obtain certificates using @ldez updated permissions. @jericdeleon FYI... You have a warning in your Route53 policy: "route53:GetChangeDetails" -- it says it does not exist. |
Merged
|
@jericdeleon soon 😉 |
|
Closed by #3998. |
|
Im still having the same issues as the original author. Im using traefik 1.7.2 with route53. my route53 policy is full access so I don't get the permission problem. |
|
The fix will come with 1.7.3 |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Do you want to request a feature or report a bug?
Bug
What did you do?
I'm using the traefik 1.7 docker image. When run docker container to create wildcard domains, I get time out. As soon as I run the container, I can see the TXT in route 53 as shown in the image. For some reason Traefik cannot validate it.
What did you expect to see?
Wildcard subdomains to be allowed.
What did you see instead?
Here is the error I get (changed the actual domain):
Thanks in advance for any help.
Originally posted by @gurumark in #3468 (comment)
What is your environment & configuration (arguments, toml, provider, platform, ...)?
configuration
The text was updated successfully, but these errors were encountered: