代码之家 › 专栏 › 技术社区 › Jan Gary

Traefik无法获取新域的SSL证书

consul traefik lets-encrypt https

Jan Gary · 技术社区 · 7 年前

我已经设置了Traefik/Docker Swarm/Let's Encrypt/conver,而且运行得很好。它成功地获得了域的证书 admin.domain.tld registry.domain.tld 和 staging.domain.tld ,但现在我尝试添加容器 domain.tld matomo.domain.tld 它们没有获得任何证书(浏览器警告自签名证书,因为它是默认的Traefik证书)。

我的Traefik配置(正在上载到conver):

debug = false
logLevel = "DEBUG"

insecureSkipVerify = true

defaultEntryPoints = ["https", "http"]

[entryPoints]
    [entryPoints.ping]
    address = ":8082"
    [entryPoints.http]
    address = ":80"
        [entryPoints.http.redirect]
        entryPoint = "https"
    [entryPoints.https]
    address = ":443"
    [entryPoints.https.tls]

[traefikLog]
    filePath = '/var/log/traefik/traefik.log'
    format = 'json'
[accessLog]
    filePath = '/var/log/traefik/access.log'
    format = 'json'
    [accessLog.fields]
        defaultMode = 'keep'
        [accessLog.fields.headers]
            defaultMode = 'keep'
            [accessLog.fields.headers.names]
                "Authorization" = "drop"

[retry]

[api]
entryPoint = "traefik"
dashboard = true
debug = false

[ping]
entryPoint = "ping"

[metrics]
    [metrics.influxdb]
    address = "http://influxdb:8086"
    protocol = "http"
    pushinterval = "10s"
    database = "metrics"

[docker]
endpoint = "unix:///var/run/docker.sock"
domain = "domain.tld"
watch = true
exposedByDefault = false
network = "net_web"
swarmMode = true

[acme]
email = "my@mail.tld"
storage = "traefik/acme/account"
entryPoint = "https"
onHostRule = true
[acme.httpChallenge]
entryPoint = "http"

可能有关联,在 traefik.log registry 子域)。将数据持久化给consur听起来像是个问题,但是没有错误表明存在这样的问题。

{"level":"debug","msg":"Looking for an existing ACME challenge for registry.domain.tld...","time":"2019-07-07T11:37:23Z"}
{"level":"debug","msg":"Looking for provided certificate to validate registry.domain.tld...","time":"2019-07-07T11:37:23Z"}
{"level":"debug","msg":"No provided certificate found for domains registry.domain.tld, get ACME certificate.","time":"2019-07-07T11:37:23Z"}
{"level":"debug","msg":"ACME got domain cert registry.domain.tld","time":"2019-07-07T11:37:23Z"}

更新: 我在日志中找到了这一行:

{"level":"error","msg":"Error getting ACME certificates [matomo.domain.tld] : cannot obtain certificates: acme: Error -\u003e One or more domains had a problem:\n[matomo.domain.tld] acme: error: 400 :: urn:ietf:paramsacme:error:connection :: Fetching http://matomo.domain.tld/.well-known/acme-challenge/WJZOZ9UC1aJl9ishmL2ACKFbKoGOe_xQoSbD34v8mSk: Timeout after connect (your server may be slow or overloaded), url: \n","time":"2019-07-09T16:27:43Z"}

因此,问题似乎是由于超时而失败的挑战。为什么要暂停?

更新2:

{"level":"debug","msg":"Looking for an existing ACME challenge for staging.domain.tld...","time":"2019-07-10T19:38:34Z"}
{"level":"debug","msg":"Looking for provided certificate to validate staging.domain.tld...","time":"2019-07-10T19:38:34Z"}
{"level":"debug","msg":"No provided certificate found for domains staging.domain.tld, get ACME certificate.","time":"2019-07-10T19:38:34Z"}
{"level":"debug","msg":"No certificate found or generated for staging.domain.tld","time":"2019-07-10T19:38:34Z"}
{"level":"debug","msg":"http: TLS handshake error from 10.255.0.2:51981: remote error: tls: unknown certificate","time":"2019-07-10T19:38:34Z"}

但是,在几分钟到一个小时之后,它就可以工作了(到目前为止,它只适用于两个域)。

0 回复 | 直到 7 年前

kritop 7 年前

 [entryPoints.http.redirect]
        entryPoint = "https"