Hello,
I have my installation mostly working. I am using dnsChallenge with digitalocean dns. The certs are fetched and working. The issue is I think I am getting to many certs. I thought that when you use a wildcard cert.. you get two. .domain.com and *.domain.com. My setup seems to get a cert for each specified sub domain I configure with a dynamic config file. So here is my static:
[global]
checkNewVersion = true
sendAnonymousUsage = true
[log]
filepath = "/etc/traefik/traefik.log"
level = "WARN"
[accessLog]
filePath = "/etc/traefik/access.log"
bufferingSize = 100
format = "json"
[accessLog.fields]
defaultMode = "drop"
[accessLog.fields.names]
"RequestHost" = "keep"
"RequestContentSize" = "keep"
"DownstreamContentSize" = "keep"
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.websecure]
address = ":443"
[entryPoints.traefik]
address = ":8080"
[providers]
[providers.file]
directory = "/etc/traefik/dynamic/"
watch = true
[api]
insecure = false
dashboard = true
debug = true
[certificatesResolvers]
[certificatesResolvers.myResolver]
[certificatesResolvers.myResolver.acme]
caServer = "https://acme-v02.api.letsencrypt.org/directory"
email = "admin@domain.com"
storage = "/etc/traefik/acme.json"
[certificatesResolvers.myResolver.acme.dnsChallenge]
provider = "digitalocean"
delayBeforeCheck = 0
resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
Here is the first subdomain "WWW"
[http]
[http.routers]
[http.routers.Router]
entryPoints = ["web"]
rule = "Host(`www.domain.com`)"
middlewares = ["httpsredirect"]
service = "www"
[http.routers.Router_secure]
entryPoints = ["websecure"]
rule = "Host(`www.domain.com`)"
service = "www"
[http.routers.Router_secure.tls]
certResolver = "myResolver"
passthrough = true
options = "mytlsoptions"
[[http.routers.Router.tls.domains]]
main = "domain.com"
sans = ["*.domain.com"]
[http.middlewares]
[http.middlewares.httpsredirect]
[http.middlewares.httpsredirect.redirectScheme]
scheme = "https"
port = "443"
permanent = true
[tls.options]
[tls.options.mytlsoptions]
minVersion = "VersionTLS12"
cipherSuites = [
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
]
[http.services]
[http.services.www]
[http.services.www.loadBalancer]
[[http.services.www.loadBalancer.servers]]
url = "http://127.0.0.1:81"
here is the second sub domain:
[http]
[http.routers]
[http.routers.demo]
entryPoints = ["web"]
rule = "Host(`demo.domain.com`)"
middlewares = ["httpsredirect"]
service = "demo"
[http.routers.demo_secure]
entryPoints = ["websecure"]
rule = "Host(`demo.domain.com`)"
service = "demo"
[http.routers.demo_secure.tls]
certResolver = "myResolver"
passthrough = true
options = "mytlsoptions"
[[http.routers.demo.tls.domains]]
main = "domain.com"
sans = ["*.domain.com"]
[http.middlewares]
[http.middlewares.httpsredirect]
[http.middlewares.httpsredirect.redirectScheme]
scheme = "https"
port = "443"
permanent = true
[tls.options]
[tls.options.mytlsoptions]
minVersion = "VersionTLS12"
cipherSuites = [
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
]
[http.services]
[http.services.demo]
[http.services.demo.loadBalancer]
[[http.services.demo.loadBalancer.servers]]
url = "http://15.245.16.147:3000"
Here is the acme.json. Yes I have removed the key data. 
{
"myResolver": {
"Account": {
"Email": "admin@domain.com",
"Registration": {
"body": {
"status": "valid",
"contact": [
"mailto:admin@domain.com"
]
},
"uri": "https://acme-v02.api.letsencrypt.org/acme/acct/81470129"
},
"PrivateKey": "MII==",
"KeyType": "4096"
},
"Certificates": [
{
"domain": {
"main": "www.domain.com"
},
"certificate": "LS0tL==",
"key": "LS0tLK",
"Store": "default"
},
{
"domain": {
"main": "demo.domain.com"
},
"certificate": "LS0==",
"key": "LS0tLS10K",
"Store": "default"
},
{
"domain": {
"main": "domain.com",
"sans": [
"*.domain.com"
]
},
"certificate": "LS0tL==",
"key": "LS0t",
"Store": "default"
}
]
}
}