ACME http2 server error with Traefik - traefik

Question

I am not sure this is a bug but I have laterally scoured every thread for the past 3 days and I am at my wits end.
I am unable to get ACME working with Traefik in swarm mode.
docker-compose.yml
version: "3.4"
services:
consul:
image: consul
command: agent -server -client='{{ GetInterfaceIP "eth0" }}' -bind='{{ GetInterfaceIP "eth0" }}' -bootstrap
networks:
- consul
volumes:
- "/srv/www/consul:/data"
deploy:
mode: global
placement:
constraints: [node.role == manager]
update_config:
parallelism: 1
delay: 45s
monitor: 15s
restart_policy:
condition: on-failure
delay: 5s
max_attempts: 10
window: 60s
traefik:
image: traefik:1.5.4
command: -c --web --logLevel=DEBUG --debug=true
deploy:
mode: global
restart_policy:
condition: on-failure
update_config:
parallelism: 1
delay: 10s
placement:
constraints:
- node.role == manager
networks:
- traefik_net
- consul
ports:
- "80:80"
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /srv/www/certs:/certs/
- /srv/www/docker/traefik.toml:/traefik.toml
traefik.toml
defaultEntryPoints = ["http", "https"]
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[docker]
watch = true
swarmmode = true
[consul]
endpoint = "consul:8500"
prefix = "traefik"
[acme]
email = "myemail#domain.com"
storage = "traefik/acme/account"
entryPoint = "https"
onDemand = false
OnHostRule = true
acmeLogging = true
The network was created like.
docker network create --driver overlay --subnet 10.1.1.0/16 traefik_net
docker network create --driver overlay consul
The errors I am getting:
level=debug msg="No provided certificate found for domains staging.example.net, get ACME certificate."
level=debug msg="Looking for an existing ACME challenge for staging.example.net..."
level=debug msg="No certificate found or generated for staging.example.net"
level=debug msg="http2: server: error reading preface from client 10.255.0.3:51514: read tcp 10.255.1.47:443->10.255.0.3:51514: read: connection reset by peer"
The thing I don't get is the ip's that are showing here are part of the ingress network.
"Containers": {
"4befecaed26dbe9667481b911a03bd6d33cfacfbc48f0a773da60bd82e88c063": {
"Name": "server_traefik.ibi1uendqffht27anh9109ozk.s87e5ykdm0s8mmmv5jjc0ps64",
"EndpointID": "377f484f6c038c31a04fc7b02e7cf94a013a8d83916d03b57f8a74463159c1ca",
"MacAddress": "02:42:0a:ff:01:2f",
"IPv4Address": "10.255.1.47/16",
"IPv6Address": ""
},
"ingress-sbox": {
"Name": "ingress-endpoint",
"EndpointID": "e83ae16d6be547f3d2141c4d48aec8e0b3a45b0de841e1e155073a5011cbbab9",
"MacAddress": "02:42:0a:ff:00:03",
"IPv4Address": "10.255.0.3/16",
"IPv6Address": ""
}
},
Any direction would be greatly appreciated.

Answer 1

You must configure the ACME challenge:
[acme]
email = "myemail#domain.com"
storage = "traefik/acme/account"
entryPoint = "https"
onDemand = false
OnHostRule = true
acmeLogging = true
[acme.httpChallenge] # <---
entryPoint = "http" # <---
https://docs.traefik.io/v1.5/configuration/acme/#acmehttpchallenge