dns entries for wilcard certificate with traefik [closed] - traefik

Question

Closed. This question is not about programming or software development. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 9 days ago.
Improve this question
I'm trying to setup traefik to generate wildcard certificates for my domain, such that containers that I create can automatically use a subdomain. For that I've installed traefik on docker (compose) with the following settings:
version: "3.3"
services:
traefik:
image: "traefik:v2.9"
container_name: "traefik"
command:
# Tell Traefik to discover containers using the Docker API
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
# Enable the Trafik dashboard
- "--api.dashboard=true"
- "--api.insecure=true"
# Set up LetsEncrypt
- "--certificatesresolvers.myresolver.acme.dnschallenge=true"
- "--certificatesresolvers.myresolver.acme.dnschallenge.provider=hetzner"
#- "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
- "--certificatesresolvers.myresolver.acme.email=my#email.com"
- "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
# Set up an insecure listener that redirects all traffic to TLS
- "--entrypoints.web.address=:80"
- "--entrypoints.web.http.redirections.entrypoint.to=websecure"
- "--entrypoints.web.http.redirections.entrypoint.scheme=https"
# Set up the TLS configuration for our websecure listener
- "--entrypoints.websecure.address=:443"
- "--entrypoints.websecure.http.tls=true"
- "--entrypoints.websecure.http.tls.certResolver=myresolver"
- "--entrypoints.websecure.http.tls.domains[0].main=domain.tld"
- "--entrypoints.websecure.http.tls.domains[0].sans=*.domain.tld"
... (some other things like ports and volumes)
As you can see I'm using the Hetzner DNS to manage the DNS records. This also works fine (I can see the _acme-challenge entries being created).
But how exactly do I need to setup the DNS records for this? I'm confused with the trailing "dots".
Here is how the zone currently looks like:
$ORIGIN domain.tld.
$TTL 7200
; SOA Records
# IN SOA ns1.your-server.de. postmaster.your-server.de. 123455678 86400 10800 3600000 3600
; NS Records
# IN NS helium.ns.hetzner.de
# IN NS hydrogen.ns.hetzner.com
# IN NS oxygen.ns.hetzner.com.
; A Records
*.domain.tld. 60 IN A 123.123.123.123
domain.tld. 60 IN A 123.123.123.123
The error I get from traefik is:
level=error msg="Unable to obtain ACME certificate for domains \"domain.tld,*.domain.tld\"" ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=myresolver.acme routerName=MY_SERVICE#docker rule="Host(`MY_SERVICE.domain.tld`)" error="unable to generate a certificate for the domains [domain.tld *.domain.tld]: error: one or more domains had a problem:\n[*.domain.tld] time limit exceeded: last error: dial udp: lookup helium.ns.hetzner.de.domain.tld.: i/o timeout\n[domain.tld] time limit exceeded: last error: read udp 172.19.0.2:34189->123.123.123.123:53: i/o timeout\n"

Answer 1

For everybody coming to this thread with the same issue. I solved my problem by appending the dot to the name servers (NS entries). Thanks #PatrickMevzek I saw that the NS entries are not a sub-domain. With this zone file everything is working now:
$ORIGIN domain.tld.
$TTL 7200
; SOA Records
# IN SOA ns1.your-server.de. postmaster.your-server.de. 123 86400 10800 3600000 3600
; NS Records
# 60 IN NS helium.ns.hetzner.de.
# 60 IN NS hydrogen.ns.hetzner.com.
# 60 IN NS oxygen.ns.hetzner.com.
; A Records
* 60 IN A 123.123.123.123
# 60 IN A 123.123.123.123
domain.tld 60 IN A 1123.123.123.123
Note the trailing dots after the NS entries.