Please help i can not understand will be work my scheme?

[fil106]

Please, can anyone try to help me understand well be working thus scheme or not?

I've hit the letsencrypt weekly certificate limit because I'm getting 8 http-01 certificates per traefik machine.

When I was looking for how I can solve this problem, I found acme2certifier and I think it should help me.

I was created acmeproxy - this is host with docker and acme2certifier container with image grindsa/acme2certifier:nginx-wsgi with
acme_srv.cfg which contains:

[DEFAULT]
debug: False

[Nonce]
# disable nonce check. THIS IS A SEVERE SECURTIY ISSUE! Please do only for testing/debugging purposes
nonce_check_disable: False

[CAhandler]
acme_keyfile: acme_srv/acme/le_staging_private_key.json
# use this url to connect to LE staging server for testing
acme_url: https://acme-staging-v02.api.letsencrypt.org
acme_account_email: example@example.com

[DBhandler]
#dbfile: /var/lib/acme/db.sqlite3

[Certificate]
revocation_reason_check_disable: False

[Challenge]
# when true disable challenge validation. Challenge will be set to 'valid' without further checking
# THIS IS A SEVERE SECURTIY ISSUE! Please do only for testing/debugging purposes
challenge_validation_disable: False

[Order]
tnauthlist_support: False

and ca_handler.py which contains code from acme_ca_handler.py

I started it and on machine with traefik i saw next error log

traefik_1  | time="2023-01-21T08:57:46Z" level=error msg="Unable to obtain ACME certificate for domains \"*.platform.example.com\" : unable to generate a certificate for the domains [*.platform.example.com]: acme: error: 403 :: POST :: http://acmeproxy.example.com:22280/acme/neworders :: urn:ietf:params:acme:error:accountDoesNotExist :: " providerName=myresolver.acme

I think I need to write a ca_handler that gets a wildcard from a DNS provider with credentials, but I'm not sure if traefik can get a wildcard certificate without asking the DNS provider and credentials.

[grindsa]

Few things which come into my mind:

• are you planning to use the same wildcard certificate on your traffik instances or different certs per instance?
• can you configure the acme client on the traffic instances in a way that it does not provision the DNS challenges?
• you could disable challenge_validation in acme2certifier. In this case your client does not need to provision the DNS challenges but this is a severe security issue

[fil106]

@grindsa Thanks for the reply

• as I understand it, in order to get around the limit of 50 certificates per week, I need to have a wildcard certificate on each machine and as I understand it, each machine will have a private key and this is a problem
• i can set up traefik to get certificates by http-01 challenge as i set it up initially and reached the limit of 50 certificates per week

At the moment, I have configured a reverse-proxy server on nginx which proxies all requests to internal servers with a wildcard certificate already received

I thought that there is a nice way to do without a reverse-proxy server but i think it is not possible

some good ideas i saw in letsencrypt forum - https://community.letsencrypt.org/t/server-proxy-for-certbot-hosts-a-lan/152011/5