State of 'Prefer Wildcard Certificate' is not persistend between restarts #671

New Issue

MrUnknownDE · 2026-04-05T17:32:47+02:00

MrUnknownDE commented

2026-04-05 17:32:47 +02:00

Originally created by @ghost on 11/5/2025

Describe the Bug

Set up wildcards long time ago and now see there is in UI: Domains - Domain Settings the Certificate resolver and Prefer Wildcard Certificate.

By default its state is off I think.
When set up as on (and use Save settings) it remain in this state, but only until the server reboot (or docker compose down / up -d).

Like this:

after saving preference:

after reboot:

The Certificate resolver is loaded right (Custom and the name of resolver) as the one I'm using.

Environment

OS Type & Version: Ubuntu 24.04.3 LTS
Pangolin Version: 1.12.1
Gerbil Version: 1.2.2
Traefik Version: v3.5

To Reproduce

As in description.

The router part of the dynamic_config.yml where the wildcard domain setting is:

 routers:
    api-router:
      entryPoints:
        - websecure
      middlewares:
        - security-headers
      rule: Host(`pangolin.sometestdo.main`) && PathPrefix(`/api/v1`)
      service: api-service
      tls:
        certResolver: some_provider
    main-app-router-redirect:
      entryPoints:
        - web
      middlewares:
        - redirect-to-https
      rule: Host(`pangolin.sometestdo.main`)
      service: next-service
    next-router:
      entryPoints:
        - websecure
      middlewares:
        - security-headers
      rule: Host(`pangolin.sometestdo.main`) && !PathPrefix(`/api/v1`)
      service: next-service
      tls:
        certResolver: some_provider
        domains:
          - main: "sometestdo.main"
            sans:
              ###- "*.sometestdo.main"
              - "*.app.sometestdo.main"

Side note: there is the commented, second-level, subdomain.
Migrating on to *.app.sometestdo.main from *.sometestdo.main as cannot use first-level subdomain.
Because of PTR/rDNS validation.

But afaik this make no difference, it used to be like this even before, with no commented line, on first-level subdomain.

While doing it, noticed this behavior.

Expected Behavior

I believe it should stay as user choose.

*Originally created by @ghost on 11/5/2025* ### Describe the Bug Set up [wildcards](https://docs.pangolin.net/self-host/advanced/wild-card-domains) long time ago and now see there is in UI: Domains - Domain Settings the Certificate resolver and Prefer Wildcard Certificate. By default its state is _off_ I think. When set up as _on_ (and use Save settings) it remain in this state, but only until the server reboot (or docker compose down / up -d). Like this: after saving preference: <img width="565" height="96" alt="Image" src="https://github.com/user-attachments/assets/f8d9d735-3b69-4ba1-a240-6401da95dc9c" /> after reboot: <img width="565" height="96" alt="Image" src="https://github.com/user-attachments/assets/9da60865-52e5-4835-91f1-684fe286781d" /> The Certificate resolver is loaded right (Custom and the name of resolver) as the one I'm using. ### Environment - OS Type & Version: Ubuntu 24.04.3 LTS - Pangolin Version: 1.12.1 - Gerbil Version: 1.2.2 - Traefik Version: v3.5 ### To Reproduce As in description. The router part of the dynamic_config.yml where the wildcard domain setting is: ``` routers: api-router: entryPoints: - websecure middlewares: - security-headers rule: Host(`pangolin.sometestdo.main`) && PathPrefix(`/api/v1`) service: api-service tls: certResolver: some_provider main-app-router-redirect: entryPoints: - web middlewares: - redirect-to-https rule: Host(`pangolin.sometestdo.main`) service: next-service next-router: entryPoints: - websecure middlewares: - security-headers rule: Host(`pangolin.sometestdo.main`) && !PathPrefix(`/api/v1`) service: next-service tls: certResolver: some_provider domains: - main: "sometestdo.main" sans: ###- "*.sometestdo.main" - "*.app.sometestdo.main" ``` Side note: there is the commented, second-level, subdomain. Migrating on to _*.app.sometestdo.main_ **from** _*.sometestdo.main_ as cannot use first-level subdomain. Because of PTR/rDNS validation. But afaik this make no difference, it used to be like this even before, with no commented line, on first-level subdomain. While doing it, noticed this behavior. ### Expected Behavior I believe it should stay as user choose.

MrUnknownDE closed this issue

2026-04-05 17:32:47 +02:00

MrUnknownDE added the bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug labels 2026-04-05 17:32:49 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#671