Wildcard Certificates Not Being Generated Despite prefer_wildcard_cert: true #663

New Issue

MrUnknownDE · 2026-04-05T17:32:21+02:00

MrUnknownDE commented

2026-04-05 17:32:21 +02:00

Originally created by @AndrewPaglusch on 11/8/2025

Describe the Bug

Possibly related to #1816

When prefer_wildcard_cert: true is set in config.yaml for domains, Traefik still generates individual certificates for each subdomain instead of requesting wildcard certificates.

 domains:
   domain1:
     base_domain: foobar1.com
     cert_resolver: letsencrypt
     prefer_wildcard_cert: true
   domain2:
     base_domain: foobar2.com
     cert_resolver: letsencrypt
     prefer_wildcard_cert: true

I believe this bug was introduced in commit d938345deb on Wed Oct 8, since there seems to be some changes being made around the preferWildcardCert setting there.

Environment

OS Type & Version: AlmaLinux 9.6
Pangolin Version: 1.12.1 (Community)
Gerbil Version: 1.2.2
Traefik Version: 3.4.0
Newt Version: 1.6.0
Olm Version: N/A

To Reproduce

Configure domains in config.yaml with prefer_wildcard_cert: true:

domains:
  domain1:
    base_domain: foobar1.com
    cert_resolver: letsencrypt
    prefer_wildcard_cert: true
  domain2:
    base_domain: foobar2.com
    cert_resolver: letsencrypt
    prefer_wildcard_cert: true

Set global preference in config.yaml:

traefik:
  cert_resolver: letsencrypt
  prefer_wildcard_cert: true

Clear the acme.json file to force certificate regeneration:
```
rm /path/to/letsencrypt/acme.json
```
Restart Pangolin and observe the Traefik logs and/or look at certs generated.

Expected Behavior

The Traefik dynamic configuration should include wildcard domain specifications like:

{
  "tls": {
    "certResolver": "letsencrypt",
    "domains": [
      {
        "main": "*.foobar1.com"
      }
    ]
  }
}

This would cause Traefik to request a single wildcard certificate covering all subdomains.

The Traefik dynamic configuration generates individual domain entries instead:

$ curl -s http://localhost:3001/api/v1/traefik-config | jq '.http.routers | to_entries | .[0] | {router: .key, tls_domains: .value.tls.domains}'
{
  "router": "605-prefix-cloud-foobar1-com-router",
  "tls_domains": [
    {
      "main": "cloud.foobar1.com"
    }
  ]
}

Every subdomain gets its own specific certificate request instead of using wildcards.

*Originally created by @AndrewPaglusch on 11/8/2025* ### Describe the Bug Possibly related to [#1816](https://github.com/fosrl/pangolin/issues/1816) When `prefer_wildcard_cert: true` is set in `config.yaml` for domains, Traefik still generates individual certificates for each subdomain instead of requesting wildcard certificates. ```yaml domains: domain1: base_domain: foobar1.com cert_resolver: letsencrypt prefer_wildcard_cert: true domain2: base_domain: foobar2.com cert_resolver: letsencrypt prefer_wildcard_cert: true ``` I believe this bug was introduced in commit https://github.com/fosrl/pangolin/commit/d938345debe8a515a8d251cdf4bd448e75ef811e on Wed Oct 8, since there seems to be some changes being made around the `preferWildcardCert` setting there. ### Environment - OS Type & Version: AlmaLinux 9.6 - Pangolin Version: 1.12.1 (Community) - Gerbil Version: 1.2.2 - Traefik Version: 3.4.0 - Newt Version: 1.6.0 - Olm Version: N/A ### To Reproduce 1. Configure domains in `config.yaml` with `prefer_wildcard_cert: true`: ```yaml domains: domain1: base_domain: foobar1.com cert_resolver: letsencrypt prefer_wildcard_cert: true domain2: base_domain: foobar2.com cert_resolver: letsencrypt prefer_wildcard_cert: true ``` 2. Set global preference in `config.yaml`: ```yaml traefik: cert_resolver: letsencrypt prefer_wildcard_cert: true ``` 3. Clear the `acme.json` file to force certificate regeneration: ```bash rm /path/to/letsencrypt/acme.json ``` 4. Restart Pangolin and observe the Traefik logs and/or look at certs generated. ### Expected Behavior The Traefik dynamic configuration should include wildcard domain specifications like: ```json { "tls": { "certResolver": "letsencrypt", "domains": [ { "main": "*.foobar1.com" } ] } } ``` This would cause Traefik to request a single wildcard certificate covering all subdomains. The Traefik dynamic configuration generates individual domain entries instead: ```bash $ curl -s http://localhost:3001/api/v1/traefik-config | jq '.http.routers | to_entries | .[0] | {router: .key, tls_domains: .value.tls.domains}' { "router": "605-prefix-cloud-foobar1-com-router", "tls_domains": [ { "main": "cloud.foobar1.com" } ] } ``` Every subdomain gets its own specific certificate request instead of using wildcards.

MrUnknownDE closed this issue

2026-04-05 17:32:21 +02:00

MrUnknownDE added the bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug labels 2026-04-05 17:32:23 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#663

Wildcard Certificates Not Being Generated Despite prefer_wildcard_cert: true #663

Describe the Bug

Environment

To Reproduce

Expected Behavior

Wildcard Certificates Not Being Generated Despite `prefer_wildcard_cert: true` #663