Self Signed Cert - Subdomain

Traefik Traefik v1
1

Hy,

I would like to know if i can use self signed certificate for like 'aaa.bbb.com' for multiple subdomains like 'site.aaa.bbb.com' , 'site2.aaa.bbb.com' ?
I'm using docker provider.

Thanks in advance
NB : Sorry for my french english :smiley:

2

Hi,

I'm not an expert but in my point of view that is not possible (you will receive an error message that your certificates are wrong).
You can

  1. build a certificate aaa.bbb.com with SAN(s), site.aaa.bbb.com and site2.aaa.bbb.com or
  2. build a *.aaa.bbb.com certificate

greetings...

3

I had a feeling it' was not possible, but i tried :smirk:
I've already try then '*.aaa.bbb.com"...

Thanks you for your reply...

4

Hello @nicolas.diakite, you can, with a lot of tools, generate a single self-signed certificate,
which will have aaa.bbb.com as main domain, and has a wildcard *.aaa.bbb.com as a "SAN" (subject alternative name).

Example with mkcert:

mkcert aaa.bbb.com "*.aaa.bbb.com"

Then follows https://docs.traefik.io/v1.7/configuration/entrypoints/#static-certificates to configure the generated certificate with Traefik.

As @cybermcm told you, by default this certificate will be seen as "not secured", but it's ok for tests. If you use mkcert, it can import the certificate authority on your webbrowser, making it look like a legit certificate on your machine only.

By the way, you can do the same with Let's Encrypt, and let Traefik auto-generate valid certificate for each domain it knows.

5

Hello @dduportal
Thank for your reply.

My goal is to use it in production so I will go with "lets encrypt" or ask to my client to pay for a wildcard cert and use it as static.

Regarding Lets encrpyt, is it mandatory to use dns challenge for wildcard, right ??

Still waiting for the "french tag" hihi

6

Yes, you are right: using DNS challenge is mandatory when one of the domain (principal or alternatives) is a wildcard.

However requesting a wildcard domain might not be required, as Traefik automates the certificates generation. By using the onHostRule, the domain name are dynamically detected from the frontend rules, and the Let's encrypt certificates are requested individually from this.

In your example, as soon as the service behind the domain site2.aaa.bbb.com, Traefik requests a single certificate for the domain site2.aaa.bbb.com, through TLS, HTTP or DNS challenge.
So you will end up with a finite colelction of certificates

(For the french tag, we'll discuss this :slight_smile: )