Error: "The server could not connect to validation target\". #1002

cgHome · 2022-08-06T12:09:42Z

cgHome
Aug 6, 2022

I'm trying to get a docker-compose running on my home server with a step-ca and traefik service and ran into the following problem. When I start the the service, then I get the error message: "The server could not connect to validation target" from the step-ca service:

traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Try to challenge certificate for domain [zeus.lan] found in HostSNI rule" ACME CA="https://step-ca:9000/acme/acme/directory" routerName=whoami@docker rule="Host(`zeus.lan`)" providerName=myresolver.acme
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Try to challenge certificate for domain [traefik-0-core] found in HostSNI rule" routerName=websecure-traefik-0-core@docker rule="Host(`traefik-0-core`)" providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Looking for provided certificate(s) to validate [\"traefik-0-core\"]..." providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory" routerName=websecure-traefik-0-core@docker rule="Host(`traefik-0-core`)"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="No ACME certificate generation required for domains [\"traefik-0-core\"]." ACME CA="https://step-ca:9000/acme/acme/directory" routerName=websecure-traefik-0-core@docker rule="Host(`traefik-0-core`)" providerName=myresolver.acme
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Looking for provided certificate(s) to validate [\"zeus.lan\"]..." routerName=whoami@docker rule="Host(`zeus.lan`)" providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="No ACME certificate generation required for domains [\"zeus.lan\"]." routerName=whoami@docker rule="Host(`zeus.lan`)" providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory"
step-ca    | time="2022-08-06T11:01:56+02:00" level=info duration=25.135911ms duration-ns=25135911 fields.time="2022-08-06T11:01:56+02:00" method=POST name=ca nonce=bUZESjhMWVdNZmlDV0JwSUtzSzV5NFVJTGhYam5XaDY path=/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/AGQAaWrkXgBajvG8R0RPUvWyp0JLwRPE protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s13uc4k9ku9cg3c0 response="{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/AGQAaWrkXgBajvG8R0RPUvWyp0JLwRPE\",\"error\":{\"type\":\"urn:ietf:params:acme:error:connection\",\"detail\":\"The server could not connect to validation target\"}}" size=318 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
step-ca    | time="2022-08-06T11:01:56+02:00" level=info duration=4.308401ms duration-ns=4308401 fields.time="2022-08-06T11:01:56+02:00" method=POST name=ca nonce=elBSVmFqSFIyb2ZzVVBVQVFtMW9TakVqM3g2Zm02bVk path=/acme/acme/authz/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5 protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s13uc4k9ku9cg3cg response="{\"identifier\":{\"type\":\"dns\",\"value\":\"zeus.lan\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/T3uxN0synYZoXUvdcudsJH8h5QkraLKc\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/ed29kNFuEEDevVLBkc3uImcXrksoMSje\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/AGQAaWrkXgBajvG8R0RPUvWyp0JLwRPE\",\"error\":{\"type\":\"urn:ietf:params:acme:error:connection\",\"detail\":\"The server could not connect to validation target\"}}],\"wildcard\":false,\"expires\":\"2022-08-07T09:01:54Z\"}" size=842 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
step-ca    | time="2022-08-06T11:02:02+02:00" level=info duration=7.310735ms duration-ns=7310735 fields.time="2022-08-06T11:02:02+02:00" method=POST name=ca nonce=TVY2VGZPcWhmNzVudUdNbVdUQWtMQ0NOR0M2TDdRcVc path=/acme/acme/authz/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s2juc4k9ku9cg3d0 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"traefik-0-core\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"0gk8cPJsyJQSyNdzfCWQnQPZk829pjzg\",\"url\":\"https://step-ca:9000/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/fntvaRYK8EFJXg0QhJgeTPZzd7HWA6Qg\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"0gk8cPJsyJQSyNdzfCWQnQPZk829pjzg\",\"url\":\"https://step-ca:9000/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/tOFr8JJUVIewjndyYorPaPusJnKX5pzD\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"0gk8cPJsyJQSyNdzfCWQnQPZk829pjzg\",\"url\":\"https://step-ca:9000/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/SZqQiyS7nN4pKtm9nyzLLDwKDAQPEcTQ\",\"error\":{\"type\":\"urn:ietf:params:acme:error:connection\",\"detail\":\"The server could not connect to validation target\"}}],\"wildcard\":false,\"expires\":\"2022-08-07T09:01:54Z\"}" size=848 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
step-ca    | time="2022-08-06T11:02:02+02:00" level=info duration=4.424573ms duration-ns=4424573 fields.time="2022-08-06T11:02:02+02:00" method=POST name=ca nonce=WFJYM2RCaVlnNzNuWEQyWVNCb0gwWWRldm1rekx4ZHU path=/acme/acme/authz/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5 protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s2juc4k9ku9cg3dg response="{\"identifier\":{\"type\":\"dns\",\"value\":\"zeus.lan\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/T3uxN0synYZoXUvdcudsJH8h5QkraLKc\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/ed29kNFuEEDevVLBkc3uImcXrksoMSje\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/AGQAaWrkXgBajvG8R0RPUvWyp0JLwRPE\",\"error\":{\"type\":\"urn:ietf:params:acme:error:connection\",\"detail\":\"The server could not connect to validation target\"}}],\"wildcard\":false,\"expires\":\"2022-08-07T09:01:54Z\"}" size=842 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
step-ca    | time="2022-08-06T11:02:07+02:00" level=info duration=10.083198ms duration-ns=10083198 fields.time="2022-08-06T11:02:07+02:00" method=POST name=ca nonce=M0MwYkZxSUhISzFtMExxZTNuSHdHZnNPYXdFdmZlUlo path=/acme/acme/authz/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5 protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s3ruc4k9ku9cg3e0 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"zeus.lan\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/T3uxN0synYZoXUvdcudsJH8h5QkraLKc\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/ed29kNFuEEDevVLBkc3uImcXrksoMSje\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/AGQAaWrkXgBajvG8R0RPUvWyp0JLwRPE\",\"error\":{\"type\":\"urn:ietf:params:acme:error:connection\",\"detail\":\"The server could not connect to validation target\"}}],\"wildcard\":false,\"expires\":\"2022-08-07T09:01:54Z\"}" size=842 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=

What is meant by this and where do I have the error ?

THX Chris

Initialization step-ca Instance

docker-compose up -d step-ca
docker-compose exec step-ca step ca provisioner add acme --type ACME
docker-compose down

docker-compose.yml:

networks:
  default:
    driver: bridge
  proxy:
    name: proxy
    external: true

services:
  step-ca:
    container_name: step-ca
    image: smallstep/step-ca
    restart: unless-stopped
    environment:
      DOCKER_STEPCA_INIT_NAME: Local
      DOCKER_STEPCA_INIT_DNS_NAMES: localdomain,step-ca,zeus.lan
      DOCKER_STEPCA_INIT_SSH: "yes"
      STEPDEBUG: 1
    ports:
      - 9000:9000
    networks:
      - proxy
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - step-ca:/home/step

  traefik:
    image: traefik:2.8
    container_name: traefik
    environment:
      LEGO_CA_CERTIFICATES: /step/certs/root_ca.crt
    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=proxy
      - --providers.docker.endpoint=unix:///var/run/docker.sock
      - --serversTransport.insecureSkipVerify=true
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https      
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.http.tls.certResolver=myresolver
      - --certificatesResolvers.myresolver.acme.tlschallenge=true
      - --certificatesResolvers.myresolver.acme.caServer=https://step-ca:9000/acme/acme/directory
      - --certificatesResolvers.myresolver.acme.storage=/acme/acme.json
      - --certificatesResolvers.myresolver.acme.email=mail@docker.localhost
      - --log.level=DEBUG
      - --api.dashboard=true
      - --global.checkNewVersion=true
      - --global.sendAnonymousUsage=false
    labels:
      - traefik.enable=true
    ports:
      - 80:80
      - 443:443
    networks:
      - default
      - proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/localtime:/etc/localtime:ro
      - traefik:/acme
      - step-ca:/step
    restart: unless-stopped
    depends_on:
      - step-ca

  whoami:
    image: traefik/whoami
    container_name: whoami
    restart: unless-stopped
    networks:
      - proxy
    labels:
      - traefik.enable=true
      #- traefik.http.routers.whoami.rule=PathPrefix(`/`)
      - traefik.http.routers.whoami.rule=Host(`zeus.lan`)
      - traefik.http.routers.whoami.entrypoints=websecure
      - traefik.http.routers.whoami.tls.certresolver=myresolver
      - traefik.http.routers.whoami.tls=true

volumes:
  step-ca:
    name: step
  traefik:
    name: traefik

ca.json:

{
	"root": "/home/step/certs/root_ca.crt",
	"federatedRoots": null,
	"crt": "/home/step/certs/intermediate_ca.crt",
	"key": "/home/step/secrets/intermediate_ca_key",
	"address": ":9000",
	"insecureAddress": "",
	"dnsNames": [
		"localdomain",
		"step-ca",
		"zeus.lan"
	],
	"ssh": {
		"hostKey": "/home/step/secrets/ssh_host_ca_key",
		"userKey": "/home/step/secrets/ssh_user_ca_key"
	},
	"logger": {
		"format": "text"
	},
	"db": {
		"type": "badgerv2",
		"dataSource": "/home/step/db",
		"badgerFileLoadingMode": ""
	},
	"authority": {
		"provisioners": [
			{
				"type": "JWK",
				"name": "admin",
				"key": {
					"use": "sig",
					"kty": "EC",
					"kid": "2Rv4DcHpYCZxV7gWSrcqLY9bKC1m1Exx2fkNEWBzgg8",
					"crv": "P-256",
					"alg": "ES256",
					"x": "eclssWHt1TS7o8ULA9V_and5rbjoEdo0O4c4G2aHZmU",
					"y": "KZIiJ68dBfbTAu5u32V107XVU45pM_ZP4mGCgxo9EaI"
				},
				"encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjEwMDAwMCwicDJzIjoiekFmSVlMdlk1M0lvMjd3MjJGbFJQUSJ9.7NELSx4a11FSONSYvELK1wOJqfBzlTuqNfNi2wsQm2c2v5U1RPmQTQ.OwuBqNXqogRoUoft.nIk5wqPr23AG2eaRAyMrpOkodIF00yaskCAxjsWrOjB2YQ0WXj0hsYBKhcs6N8VaqzYP-ZRB-Wo6jV5qOVMc8RQ3eK5CzZvGR4FpaHkJxFIQisuCultvz_IbszbCWRG773p97nF_Xx4NXrBh-t-k-Mn157f03AHgzVbP7Nd49GaSJcHdQdhKrFlhrnQP0AnnOsBBffQ5_-Pg7XCpsWd24XEUf4-73DH9O0h5fWkU4XrM90K-am7WFdH3ujasSDKNZOL4IXcieczpNLwVUdUQ6ksqZK6_JrWP8FlxVMwUTJzYwK1mm_pONsP68HQ4rsYIIyd0Ntl80UvwW8lw0DA.Ep6cbqzX4mmf89Xs0B55Zw",
				"claims": {
					"enableSSHCA": true
				}
			},
			{
				"type": "SSHPOP",
				"name": "sshpop",
				"claims": {
					"enableSSHCA": true
				}
			},
			{
				"type": "ACME",
				"name": "acme",
				"claims": {
					"enableSSHCA": true,
					"disableRenewal": false,
					"allowRenewalAfterExpiry": false
				},
				"options": {
					"x509": {},
					"ssh": {}
				}
			}
		],
		"template": {},
		"backdate": "1m0s"
	},
	"tls": {
		"cipherSuites": [
			"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
		],
		"minVersion": 1.2,
		"maxVersion": 1.3,
		"renegotiation": false
	},
	"templates": {
		"ssh": {
			"user": [
				{
					"name": "config.tpl",
					"type": "snippet",
					"template": "templates/ssh/config.tpl",
					"path": "~/.ssh/config",
					"comment": "#"
				},
				{
					"name": "step_includes.tpl",
					"type": "prepend-line",
					"template": "templates/ssh/step_includes.tpl",
					"path": "${STEPPATH}/ssh/includes",
					"comment": "#"
				},
				{
					"name": "step_config.tpl",
					"type": "file",
					"template": "templates/ssh/step_config.tpl",
					"path": "ssh/config",
					"comment": "#"
				},
				{
					"name": "known_hosts.tpl",
					"type": "file",
					"template": "templates/ssh/known_hosts.tpl",
					"path": "ssh/known_hosts",
					"comment": "#"
				}
			],
			"host": [
				{
					"name": "sshd_config.tpl",
					"type": "snippet",
					"template": "templates/ssh/sshd_config.tpl",
					"path": "/etc/ssh/sshd_config",
					"comment": "#",
					"requires": [
						"Certificate",
						"Key"
					]
				},
				{
					"name": "ca.tpl",
					"type": "snippet",
					"template": "templates/ssh/ca.tpl",
					"path": "/etc/ssh/ca.pub",
					"comment": "#"
				}
			]
		}
	},
	"commonName": "Step Online CA"
}

acme.json

{
  "myresolver": {
    "Account": {
      "Email": "mail@docker.localhost",
      "Registration": {
        "body": {
          "status": "valid",
          "contact": [
            "mailto:mail@docker.localhost"
          ],
          "orders": "https://step-ca:9000/acme/acme/account/paKyxUC5l6bkthpOjNpOnDXl2xcmgHOd/orders"
        },
        "uri": "https://step-ca:9000/acme/acme/account/paKyxUC5l6bkthpOjNpOnDXl2xcmgHOd"
      },
      "PrivateKey": "MIIJKgIBAAKCAgEApraKd8HvMpuOgRIKltEsaPvTRvK9jbIXPL5zqjNbOLl7bqFesOmW3KyvSpeeVmzyot+ZEsBH05SzXdUufBOKADBNKR09rJ1DEn1KUDysIQ2r1BB5HV1+rylQoq57yalww14feK0KLZQIO6B7D9fu6tmX5/xA1z0jQPgQj6iq4KyfPRiNrog8R5QPDdS33swD9FIxVJeMXSWddXeWR0iY1si6RJcr9ec8prTB0qZ+JXWR4VZuIlBk4VzdEqpZo4ESdsT0sr0tKTDiXZ6+QsPnMpQpEOBT5BuoKV+6UZkgrHEcPzsaUOijLIe1M1y5tOCXghf89h+Hh60PxvXNG7S3YQ3c59BL90k18MZRxoNpNwBvbnlpRfrJt/H5xDpAo/iAXx3HeAreepTAzpLC7mQMe+KDx0jjm3T1Pg+sFk4RhYe+m53DoUBE/B7H5B/ehp/0bcDYVfo9hvCbpnpIOW98zksWlf0vVnom/kBYSBdz6LVoiXQHM7d7iBPvBMmdn7Hmo9F951sYr157VgW0TF5Hd4FhJe63A7WaJMmwYYCFWwS1PrNAtG69VrvAFUQKvqaH9IEqNU+P/hlgmuLfId9K0VWBCG140eRrmyM+lg0zHhHu4+3unCa4tFKIyFvjPqIpH87JQI4eYu9QcbMtLtfROz9JGnqMqZ0NdYYc9VJWFAMCAwEAAQKCAgAbu4XxQgueaY4dHnkweX9fv3R3+u1ZYuTGsA/hokVsfD5yOtnbqB/2eat3Rx2J1vnN6lA2dFH+emAUHeBrt3xfZ6mOS1T1H/wGWV1BV7ZykSmiT1M2dVUbok3NoiTpeQxPE5s8odxtlJCCCsIt8ofF/YhtiOLoaz0wE5P9sdsrIMwkh68Z94O/jHusm1Qy9dE6lWmrXsJ0xEsbPVd8aDE0mZOS0Wr4rwzB1pPfjN6zMImh6JTNlH4TlzUXY8shjdkadM0X5qxai808MaoIxTnyif8C1a5e5dLlfw0pgcWTqgU+54ALMYfjYnfcIXKrCilp9L+Z2cjb4wga2szR7RAMCliGx+ZMAaNNf6vOFA7WlnieFYMX1d+TDGy4d3P8GIbJ0Wwskf8A/v7KicnMp/pwruXto7u1y5seHukSRIua7JOjtdpmfl/dZPmg9poT8udOiSSbt3SHOBhOWJrWEaNFa2ZNSp4iE1fMZXOBur+/7ryEE6YiHo9jG5NTuISxKlI6ghXQ9//SHxNsg1dOyu6vSwyJRSyPF4rUKgvNpVCWwlqlRXXZbZe60Lsal6kDaFYkXo6wYtYfM7QcnRuo73HcitcSAuOx+qwa456GdPd4X+dj0Hi7zVRFK/LN/ahLBlplFBpi/Ui4KhGMV119G1uY2LXbBpewt3bF5CGmuqah4QKCAQEAyg8EidMewaoRhTRQUlze695Dce8nmaghq7/RI7Tfl7v6EJHegYmbKXUYDhO10u7vkkdK4f2k46WAlyIJZPBjtvZplrK91I7rv8e5oQRTGDLzu8vLZfn5208hA/P5yDAIUtBcerfsw1UTy0uy9FmE41B2THXGuTJQW3S/pSRFxo8JUBi39bCBILkVUjH/XEgfIBR1uPVTP1/Dpub980S6sIY7ZnJAxVOSHbWJ1X/y/d93RSlK5q7YympgBCJD1wuVEG9VCmFTHNVD1uz0OgaTt90ohyhqQiBRY8Whv+RGH7/8Htb97EFp3jSCk/V8Z0av9vukwU/DxzMjJW+28vORawKCAQEA0zfz4/aqCWrsea0JPRiuLmp08oDlk9GuCb4JuHd9Q0DLPXECWxUGij/7oq+6JTa0h6+s+HReX7I60RXJhspC67ndXRnltCsCZzH/AGa0SDssVLhEmfzayzN6r6Tqr0ybi7NOMvhcA1O65oQf9M8XQheiD8ynEkHaJWBo1rEy3ljyLfrVjv+W2w0rdKDrCRnr5loo0epakANYPTpkItOrG78/aUmF8Z3LXoxGVHyKWOyR+dqGJypEfx2sEkAtYAz8AbtoewzcarzclokYO5OMMrgVq1Qc/hhN40G4R8h6BUQBHDXo2FkcgYwfAO4L7s97csnTi/6v2MbMyotEwKl1yQKCAQEAlDJNjtSkc0BMF1mWK8Jn0bEz4GWass0o3PIT709iysQZFXwXKQUHI3H5UaHNMscCOVRGrNe+zyR82twg7cKOMAwsx1WTe0nTyNYw5NLqKw57y1oedU3RnrM7sM2JfvUTtcGSgoNRiLZmjS2ZNDRQDfTevxeGyCAJ5foL8ZBYCNix6OgoTG/HVXvKEn4PH9zZz0qSSTTNeObA9jHnQjw/fOcGvA3CSbgQq++RB2EPlHoI3VX61JSa9mLsxztmbFvXWbV+Nt3I+pXEaudh/QkD4M+5QOA4hwVzDG1QRBCmCfVicjAXDuevQUVcHC7prkmfF9PbM9lP61MrTPLRyQExvwKCAQEAhI+KPtkxMEXt8hN6R+D0eGcRzJy++P3Q14ZwfVhowkupAn+pddaFS0EKwbi9/9sMhFfqG+iUzkSCi3S8DR9lzqHQ3zyAoImZsYB8RRkwLmEM2oLncylxe7RsXE4JiElxGcVH389lmCT1mPT1RWSveShx6q6LcHbp3SlbwtplTYzPObJCU8PvPr1ON51CxWyCVAjjs5L8kYO33n2GGSF1My3dM0wUh2Z8G3O4NBARl+upVgEizvPFF25c7vtePvkHNGMVGJ0ivM6ZNtUF42YfyDkmSGe65nIEeAtoB403n5Rlifn/j8ClllyFnMTJsnB/TrSCU0tdu5RRNREg7jWsmQKCAQEAuzKkjt7ahHbgEjbq1pDj1GSANFq9d0cHMwOTRfNsO96CqvidXnyx8PUXgaLts60OkdCmol0GBzLktXLCVBvReZJN096TopMs8XZ/BfOUihYp+oY6yONX/tsIo30jizOm2fHUeXx3XsF29SdNoX4SJRJ7dVRFrcHk6/nptplMAUnDqZdKlGNk+1iLcFIZtkvbnIrdAu1iQGUXVEOBSjsv/TGOhwLRfXx2nURg+8ZPc10tQNWckO3i1YzHc8N9eZPSFVtWO/SgZ8usEogWKnjmPgYbfjJtnRwWwj1q3bOMjXPkRu8LO0g0ZJex+h+ZV+QTfqYEe5AU9TgnrfcA/1YVNg==",
      "KeyType": "4096"
    },
    "Certificates": null
  }
}

log-file:

[/share/Container/data/home.server/0-core] # docker-compose --env-file=../stack.env --file test.yml up  
Creating network "0-core_default" with driver "bridge"
Creating volume "traefik" with default driver
Creating whoami  ... done
Creating step-ca ... done
Creating traefik ... done
Attaching to whoami, step-ca, traefik
step-ca    | badger 2022/08/06 11:01:44 INFO: All 1 tables opened in 2ms
step-ca    | badger 2022/08/06 11:01:44 INFO: Replaying file id: 0 at offset: 268259
step-ca    | badger 2022/08/06 11:01:44 INFO: Replay took: 53.726µs
step-ca    | 2022/08/06 11:01:44 Starting Smallstep CA/0.21.0 (linux/amd64)
step-ca    | 2022/08/06 11:01:44 Documentation: https://u.step.sm/docs/ca
step-ca    | 2022/08/06 11:01:44 Community Discord: https://u.step.sm/discord
step-ca    | 2022/08/06 11:01:44 Config file: /home/step/config/ca.json
step-ca    | 2022/08/06 11:01:44 The primary server URL is https://localdomain:9000
step-ca    | 2022/08/06 11:01:44 Root certificates are available at https://localdomain:9000/roots.pem
step-ca    | 2022/08/06 11:01:44 Additional configured hostnames: step-ca, zeus.lan
step-ca    | 2022/08/06 11:01:44 X.509 Root Fingerprint: 1ffcc83fe367b7e078c7c0c6a35a0337f776abbbb04112af9bcb7789072295ce
step-ca    | 2022/08/06 11:01:44 SSH Host CA Key: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAbR6tG7F4p0bOLR5DxUATplW1g4IZbHotmnDSVyN02w7rgcGIuFl1DfZfSyhRaujo2bLw6lieLTdc54z3JkXLU=
step-ca    | 
step-ca    | 2022/08/06 11:01:44 SSH User CA Key: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBG/aCF1a7xZSt3AMmxllDambyV++Iyn5ZlinzV01OYXy9yhnddmETCH2MBuinNPMc2BA4Gi6bqTTN8NyD+6v79c=
step-ca    | 
step-ca    | 2022/08/06 11:01:44 Serving HTTPS on :9000 ...
whoami     | 2022/08/06 09:01:44 Starting up on port 80
traefik    | time="2022-08-06T11:01:46+02:00" level=info msg="Configuration loaded from flags."
traefik    | time="2022-08-06T11:01:46+02:00" level=info msg="Traefik version 2.8.1 built on 2022-07-11T14:06:57Z"
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="Static configuration loaded {\"global\":{\"checkNewVersion\":true},\"serversTransport\":{\"insecureSkipVerify\":true,\"maxIdleConnsPerHost\":200},\"entryPoints\":{\"web\":{\"address\":\":80\",\"transport\":{\"lifeCycle\":{\"graceTimeOut\":\"10s\"},\"respondingTimeouts\":{\"idleTimeout\":\"3m0s\"}},\"forwardedHeaders\":{},\"http\":{\"redirections\":{\"entryPoint\":{\"to\":\"websecure\",\"scheme\":\"https\",\"permanent\":true,\"priority\":2147483646}}},\"http2\":{\"maxConcurrentStreams\":250},\"udp\":{\"timeout\":\"3s\"}},\"websecure\":{\"address\":\":443\",\"transport\":{\"lifeCycle\":{\"graceTimeOut\":\"10s\"},\"respondingTimeouts\":{\"idleTimeout\":\"3m0s\"}},\"forwardedHeaders\":{},\"http\":{\"tls\":{\"certResolver\":\"myresolver\"}},\"http2\":{\"maxConcurrentStreams\":250},\"udp\":{\"timeout\":\"3s\"}}},\"providers\":{\"providersThrottleDuration\":\"2s\",\"docker\":{\"watch\":true,\"endpoint\":\"unix:///var/run/docker.sock\",\"defaultRule\":\"Host(`{{ normalize .Name }}`)\",\"network\":\"proxy\",\"swarmModeRefreshSeconds\":\"15s\"}},\"api\":{\"dashboard\":true},\"log\":{\"level\":\"DEBUG\",\"format\":\"common\"},\"certificatesResolvers\":{\"myresolver\":{\"acme\":{\"email\":\"mail@docker.localhost\",\"caServer\":\"https://step-ca:9000/acme/acme/directory\",\"storage\":\"/acme/acme.json\",\"keyType\":\"RSA4096\",\"certificatesDuration\":2160,\"tlsChallenge\":{}}}},\"pilot\":{\"dashboard\":true}}"
traefik    | time="2022-08-06T11:01:46+02:00" level=info msg="\nStats collection is disabled.\nHelp us improve Traefik by turning this feature on :)\nMore details on: https://doc.traefik.io/traefik/contributing/data-collection/\n"
traefik    | time="2022-08-06T11:01:46+02:00" level=warning msg="Traefik Pilot is deprecated and will be removed soon. Please check our Blog for migration instructions later this year."
traefik    | time="2022-08-06T11:01:46+02:00" level=info msg="Starting provider aggregator aggregator.ProviderAggregator"
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="Starting TCP Server" entryPointName=websecure
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="Starting TCP Server" entryPointName=web
traefik    | time="2022-08-06T11:01:46+02:00" level=info msg="Starting provider *traefik.Provider"
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="*traefik.Provider provider configuration: {}"
traefik    | time="2022-08-06T11:01:46+02:00" level=info msg="Starting provider *acme.ChallengeTLSALPN"
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="*acme.ChallengeTLSALPN provider configuration: {}"
traefik    | time="2022-08-06T11:01:46+02:00" level=info msg="Starting provider *docker.Provider"
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="*docker.Provider provider configuration: {\"watch\":true,\"endpoint\":\"unix:///var/run/docker.sock\",\"defaultRule\":\"Host(`{{ normalize .Name }}`)\",\"network\":\"proxy\",\"swarmModeRefreshSeconds\":\"15s\"}"
traefik    | time="2022-08-06T11:01:46+02:00" level=info msg="Starting provider *acme.Provider"
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="Configuration received: {\"http\":{\"routers\":{\"web-to-websecure\":{\"entryPoints\":[\"web\"],\"middlewares\":[\"redirect-web-to-websecure\"],\"service\":\"noop@internal\",\"rule\":\"HostRegexp(`{host:.+}`)\",\"priority\":2147483646}},\"services\":{\"api\":{},\"dashboard\":{},\"noop\":{}},\"middlewares\":{\"redirect-web-to-websecure\":{\"redirectScheme\":{\"scheme\":\"https\",\"port\":\"443\",\"permanent\":true}}},\"models\":{\"websecure\":{\"tls\":{\"certResolver\":\"myresolver\"}}},\"serversTransports\":{\"default\":{\"insecureSkipVerify\":true,\"maxIdleConnsPerHost\":200}}},\"tcp\":{},\"udp\":{},\"tls\":{}}" providerName=internal
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="No default certificate, generating one" tlsStoreName=default
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="*acme.Provider provider configuration: {\"email\":\"mail@docker.localhost\",\"caServer\":\"https://step-ca:9000/acme/acme/directory\",\"storage\":\"/acme/acme.json\",\"keyType\":\"RSA4096\",\"certificatesDuration\":2160,\"tlsChallenge\":{},\"ResolverName\":\"myresolver\",\"store\":{},\"TLSChallengeProvider\":{},\"HTTPChallengeProvider\":{}}"
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="Attempt to renew certificates \"720h0m0s\" before expiry and check every \"24h0m0s\"" providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory"
traefik    | time="2022-08-06T11:01:46+02:00" level=info msg="Testing certificate renew..." providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory"
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="Configuration received: {\"http\":{},\"tcp\":{},\"udp\":{},\"tls\":{}}" providerName=myresolver.acme
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="Provider connection established with docker 20.10.14-qnap2 (API 1.41)" providerName=docker
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="Filtering disabled container" providerName=docker container=step-ca-0-core-6ccc0d42d44383817d8689d26ef28d56abe1e2abd009537035ce7b9cc4a70305
traefik    | time="2022-08-06T11:01:46+02:00" level=debug msg="Configuration received: {\"http\":{\"routers\":{\"traefik-0-core\":{\"service\":\"traefik-0-core\",\"rule\":\"Host(`traefik-0-core`)\"},\"whoami\":{\"entryPoints\":[\"websecure\"],\"service\":\"whoami-0-core\",\"rule\":\"Host(`zeus.lan`)\",\"tls\":{\"certResolver\":\"myresolver\"}}},\"services\":{\"traefik-0-core\":{\"loadBalancer\":{\"servers\":[{\"url\":\"http://172.29.152.4:80\"}],\"passHostHeader\":true}},\"whoami-0-core\":{\"loadBalancer\":{\"servers\":[{\"url\":\"http://172.29.152.2:80\"}],\"passHostHeader\":true}}}},\"tcp\":{},\"udp\":{}}" providerName=docker
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Added outgoing tracing middleware noop@internal" middlewareType=TracingForwarder entryPointName=web routerName=web-to-websecure@internal middlewareName=tracing
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating middleware" routerName=web-to-websecure@internal entryPointName=web middlewareName=redirect-web-to-websecure@internal middlewareType=RedirectScheme
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Setting up redirection to https 443" middlewareType=RedirectScheme routerName=web-to-websecure@internal entryPointName=web middlewareName=redirect-web-to-websecure@internal
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Adding tracing to middleware" routerName=web-to-websecure@internal middlewareName=redirect-web-to-websecure@internal entryPointName=web
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating middleware" entryPointName=web middlewareName=traefik-internal-recovery middlewareType=Recovery
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="No entryPoint defined for this router, using the default one(s) instead: [web websecure]" routerName=traefik-0-core
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="No default certificate, generating one" tlsStoreName=default
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Added outgoing tracing middleware noop@internal" middlewareName=tracing middlewareType=TracingForwarder entryPointName=web routerName=web-to-websecure@internal
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating middleware" entryPointName=web routerName=web-to-websecure@internal middlewareName=redirect-web-to-websecure@internal middlewareType=RedirectScheme
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Setting up redirection to https 443" middlewareType=RedirectScheme entryPointName=web routerName=web-to-websecure@internal middlewareName=redirect-web-to-websecure@internal
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Adding tracing to middleware" entryPointName=web routerName=web-to-websecure@internal middlewareName=redirect-web-to-websecure@internal
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating middleware" routerName=traefik-0-core@docker entryPointName=web serviceName=traefik-0-core middlewareName=pipelining middlewareType=Pipelining
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating load-balancer" serviceName=traefik-0-core routerName=traefik-0-core@docker entryPointName=web
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating server 0 http://172.29.152.4:80" serverName=0 routerName=traefik-0-core@docker entryPointName=web serviceName=traefik-0-core
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="child http://172.29.152.4:80 now UP"
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Propagating new UP status"
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Added outgoing tracing middleware traefik-0-core" entryPointName=web routerName=traefik-0-core@docker middlewareName=tracing middlewareType=TracingForwarder
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating middleware" middlewareType=Recovery entryPointName=web middlewareName=traefik-internal-recovery
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating middleware" serviceName=traefik-0-core entryPointName=websecure middlewareName=pipelining middlewareType=Pipelining routerName=websecure-traefik-0-core@docker
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating load-balancer" entryPointName=websecure routerName=websecure-traefik-0-core@docker serviceName=traefik-0-core
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating server 0 http://172.29.152.4:80" serviceName=traefik-0-core entryPointName=websecure routerName=websecure-traefik-0-core@docker serverName=0
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="child http://172.29.152.4:80 now UP"
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Propagating new UP status"
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Added outgoing tracing middleware traefik-0-core" middlewareType=TracingForwarder entryPointName=websecure routerName=websecure-traefik-0-core@docker middlewareName=tracing
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating middleware" middlewareType=Pipelining middlewareName=pipelining entryPointName=websecure routerName=whoami@docker serviceName=whoami-0-core
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating load-balancer" routerName=whoami@docker serviceName=whoami-0-core entryPointName=websecure
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating server 0 http://172.29.152.2:80" entryPointName=websecure routerName=whoami@docker serviceName=whoami-0-core serverName=0
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="child http://172.29.152.2:80 now UP"
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Propagating new UP status"
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Added outgoing tracing middleware whoami-0-core" middlewareName=tracing middlewareType=TracingForwarder entryPointName=websecure routerName=whoami@docker
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Creating middleware" middlewareType=Recovery entryPointName=websecure middlewareName=traefik-internal-recovery
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Adding route for traefik-0-core with TLS options default" entryPointName=websecure
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Adding route for zeus.lan with TLS options default" entryPointName=websecure
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Try to challenge certificate for domain [traefik-0-core] found in HostSNI rule" ACME CA="https://step-ca:9000/acme/acme/directory" routerName=websecure-traefik-0-core@docker rule="Host(`traefik-0-core`)" providerName=myresolver.acme
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Try to challenge certificate for domain [zeus.lan] found in HostSNI rule" rule="Host(`zeus.lan`)" ACME CA="https://step-ca:9000/acme/acme/directory" providerName=myresolver.acme routerName=whoami@docker
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Looking for provided certificate(s) to validate [\"zeus.lan\"]..." ACME CA="https://step-ca:9000/acme/acme/directory" providerName=myresolver.acme routerName=whoami@docker rule="Host(`zeus.lan`)"
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Domains [\"zeus.lan\"] need ACME certificates generation for domains \"zeus.lan\"." rule="Host(`zeus.lan`)" ACME CA="https://step-ca:9000/acme/acme/directory" providerName=myresolver.acme routerName=whoami@docker
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Loading ACME certificates [zeus.lan]..." providerName=myresolver.acme routerName=whoami@docker rule="Host(`zeus.lan`)" ACME CA="https://step-ca:9000/acme/acme/directory"
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Looking for provided certificate(s) to validate [\"traefik-0-core\"]..." ACME CA="https://step-ca:9000/acme/acme/directory" routerName=websecure-traefik-0-core@docker rule="Host(`traefik-0-core`)" providerName=myresolver.acme
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Domains [\"traefik-0-core\"] need ACME certificates generation for domains \"traefik-0-core\"." routerName=websecure-traefik-0-core@docker rule="Host(`traefik-0-core`)" providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory"
traefik    | time="2022-08-06T11:01:47+02:00" level=debug msg="Loading ACME certificates [traefik-0-core]..." providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory" routerName=websecure-traefik-0-core@docker rule="Host(`traefik-0-core`)"
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="Building ACME client..." providerName=myresolver.acme
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="https://step-ca:9000/acme/acme/directory" providerName=myresolver.acme
step-ca    | time="2022-08-06T11:01:54+02:00" level=info duration="229.882µs" duration-ns=229882 fields.time="2022-08-06T11:01:54+02:00" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s0juc4k9ku9cg370 response="{\"newNonce\":\"https://step-ca:9000/acme/acme/new-nonce\",\"newAccount\":\"https://step-ca:9000/acme/acme/new-account\",\"newOrder\":\"https://step-ca:9000/acme/acme/new-order\",\"revokeCert\":\"https://step-ca:9000/acme/acme/revoke-cert\",\"keyChange\":\"https://step-ca:9000/acme/acme/key-change\",\"meta\":{}}" size=292 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
traefik    | time="2022-08-06T11:01:54+02:00" level=info msg=Register... providerName=myresolver.acme
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="legolog: [INFO] acme: Registering account for mail@docker.localhost"
step-ca    | time="2022-08-06T11:01:54+02:00" level=info duration=8.09599ms duration-ns=8095990 fields.time="2022-08-06T11:01:54+02:00" method=HEAD name=ca nonce=MWlYaFJ0Uk0wRHRVejVCZW5wWjVVdEFjOGE4SW5XUVI path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s0juc4k9ku9cg37g size=0 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
step-ca    | time="2022-08-06T11:01:54+02:00" level=info duration=8.032948ms duration-ns=8032948 fields.time="2022-08-06T11:01:54+02:00" method=POST name=ca nonce=alBwek1JcXhJNmZsSkpHUk1QSGtnUGZjb0NYenNaVVc path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s0juc4k9ku9cg380 response="{\"contact\":[\"mailto:mail@docker.localhost\"],\"status\":\"valid\",\"orders\":\"https://step-ca:9000/acme/acme/account/paKyxUC5l6bkthpOjNpOnDXl2xcmgHOd/orders\"}" size=152 status=201 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="Using TLS Challenge provider." providerName=myresolver.acme
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="legolog: [INFO] [zeus.lan] acme: Obtaining bundled SAN certificate"
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="legolog: [INFO] [traefik-0-core] acme: Obtaining bundled SAN certificate"
step-ca    | time="2022-08-06T11:01:54+02:00" level=info duration=2.198061ms duration-ns=2198061 fields.time="2022-08-06T11:01:54+02:00" method=HEAD name=ca nonce=MHM2OGo2cURTanJQTmh6a3FwMU9IMUlxenJ3Rm9OcWk path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s0juc4k9ku9cg38g size=0 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
step-ca    | time="2022-08-06T11:01:54+02:00" level=info duration=14.777745ms duration-ns=14777745 fields.time="2022-08-06T11:01:54+02:00" method=POST name=ca nonce=aDh1VkdRd1pGc2cyUnZBRThlVm5mdjM2a2hoVDBWR2k path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s0juc4k9ku9cg390 response="{\"id\":\"ZtwOGY11mvwZW9MyfQQH0j04amVOTAvh\",\"status\":\"pending\",\"expires\":\"2022-08-07T09:01:54Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"zeus.lan\"}],\"notBefore\":\"2022-08-06T09:00:54Z\",\"notAfter\":\"2022-08-07T09:01:54Z\",\"authorizations\":[\"https://step-ca:9000/acme/acme/authz/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5\"],\"finalize\":\"https://step-ca:9000/acme/acme/order/ZtwOGY11mvwZW9MyfQQH0j04amVOTAvh/finalize\"}" size=396 status=201 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
step-ca    | time="2022-08-06T11:01:54+02:00" level=info duration=14.645345ms duration-ns=14645345 fields.time="2022-08-06T11:01:54+02:00" method=POST name=ca nonce=RDlDdkJPZnVlQWQyWmJGOGt0SUgzVHI4QlhhRW5VRkk path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s0juc4k9ku9cg39g response="{\"id\":\"hfD2jTzlNBmfMHuoJuvwAUshIUQTZtYh\",\"status\":\"pending\",\"expires\":\"2022-08-07T09:01:54Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"traefik-0-core\"}],\"notBefore\":\"2022-08-06T09:00:54Z\",\"notAfter\":\"2022-08-07T09:01:54Z\",\"authorizations\":[\"https://step-ca:9000/acme/acme/authz/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj\"],\"finalize\":\"https://step-ca:9000/acme/acme/order/hfD2jTzlNBmfMHuoJuvwAUshIUQTZtYh/finalize\"}" size=402 status=201 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
step-ca    | time="2022-08-06T11:01:54+02:00" level=info duration=4.751873ms duration-ns=4751873 fields.time="2022-08-06T11:01:54+02:00" method=POST name=ca nonce=OFpmU05jZVo1UmxUY1NPNFc1OFBCS0hIbHBwSGF3WGQ path=/acme/acme/authz/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5 protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s0juc4k9ku9cg3a0 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"zeus.lan\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/T3uxN0synYZoXUvdcudsJH8h5QkraLKc\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/ed29kNFuEEDevVLBkc3uImcXrksoMSje\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/AGQAaWrkXgBajvG8R0RPUvWyp0JLwRPE\"}],\"wildcard\":false,\"expires\":\"2022-08-07T09:01:54Z\"}" size=724 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="legolog: [INFO] [zeus.lan] AuthURL: https://step-ca:9000/acme/acme/authz/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5"
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="legolog: [INFO] [zeus.lan] acme: use tls-alpn-01 solver"
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="legolog: [INFO] [zeus.lan] acme: Trying to solve TLS-ALPN-01"
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="TLS Challenge Present temp certificate for zeus.lan" providerName=tlsalpn.acme
step-ca    | time="2022-08-06T11:01:54+02:00" level=info duration=4.480001ms duration-ns=4480001 fields.time="2022-08-06T11:01:54+02:00" method=POST name=ca nonce=dmUxT0hDYkxkRDdzVDZRTnI0bm5wUkI3TEpocDhHOUE path=/acme/acme/authz/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s0juc4k9ku9cg3ag response="{\"identifier\":{\"type\":\"dns\",\"value\":\"traefik-0-core\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"0gk8cPJsyJQSyNdzfCWQnQPZk829pjzg\",\"url\":\"https://step-ca:9000/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/fntvaRYK8EFJXg0QhJgeTPZzd7HWA6Qg\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"0gk8cPJsyJQSyNdzfCWQnQPZk829pjzg\",\"url\":\"https://step-ca:9000/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/tOFr8JJUVIewjndyYorPaPusJnKX5pzD\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"0gk8cPJsyJQSyNdzfCWQnQPZk829pjzg\",\"url\":\"https://step-ca:9000/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/SZqQiyS7nN4pKtm9nyzLLDwKDAQPEcTQ\"}],\"wildcard\":false,\"expires\":\"2022-08-07T09:01:54Z\"}" size=730 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="legolog: [INFO] [traefik-0-core] AuthURL: https://step-ca:9000/acme/acme/authz/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj"
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="legolog: [INFO] [traefik-0-core] acme: use tls-alpn-01 solver"
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="TLS Challenge Present temp certificate for traefik-0-core" providerName=tlsalpn.acme
traefik    | time="2022-08-06T11:01:54+02:00" level=debug msg="legolog: [INFO] [traefik-0-core] acme: Trying to solve TLS-ALPN-01"
traefik    | time="2022-08-06T11:01:55+02:00" level=debug msg="Configuration received: {\"http\":{},\"tcp\":{},\"udp\":{},\"tls\":{}}" providerName=tlsalpn.acme
traefik    | time="2022-08-06T11:01:55+02:00" level=debug msg="No entryPoint defined for this router, using the default one(s) instead: [web websecure]" routerName=traefik-0-core
traefik    | time="2022-08-06T11:01:55+02:00" level=debug msg="No default certificate, generating one" tlsStoreName=default
traefik    | time="2022-08-06T11:01:55+02:00" level=debug msg="Configuration received: {\"http\":{},\"tcp\":{},\"udp\":{},\"tls\":{}}" providerName=tlsalpn.acme
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Adding certificate for domain(s) acme challenge temp,traefik-0-core"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating middleware" entryPointName=web routerName=traefik-0-core@docker middlewareName=pipelining middlewareType=Pipelining serviceName=traefik-0-core
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating load-balancer" entryPointName=web routerName=traefik-0-core@docker serviceName=traefik-0-core
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating server 0 http://172.29.152.4:80" routerName=traefik-0-core@docker serviceName=traefik-0-core serverName=0 entryPointName=web
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="child http://172.29.152.4:80 now UP"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Propagating new UP status"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Added outgoing tracing middleware traefik-0-core" entryPointName=web routerName=traefik-0-core@docker middlewareName=tracing middlewareType=TracingForwarder
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Added outgoing tracing middleware noop@internal" middlewareName=tracing middlewareType=TracingForwarder entryPointName=web routerName=web-to-websecure@internal
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating middleware" entryPointName=web routerName=web-to-websecure@internal middlewareName=redirect-web-to-websecure@internal middlewareType=RedirectScheme
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Setting up redirection to https 443" middlewareType=RedirectScheme entryPointName=web routerName=web-to-websecure@internal middlewareName=redirect-web-to-websecure@internal
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Adding tracing to middleware" middlewareName=redirect-web-to-websecure@internal entryPointName=web routerName=web-to-websecure@internal
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating middleware" entryPointName=web middlewareName=traefik-internal-recovery middlewareType=Recovery
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating middleware" routerName=websecure-traefik-0-core@docker serviceName=traefik-0-core middlewareName=pipelining middlewareType=Pipelining entryPointName=websecure
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating load-balancer" entryPointName=websecure routerName=websecure-traefik-0-core@docker serviceName=traefik-0-core
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating server 0 http://172.29.152.4:80" routerName=websecure-traefik-0-core@docker serviceName=traefik-0-core serverName=0 entryPointName=websecure
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="child http://172.29.152.4:80 now UP"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Propagating new UP status"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Added outgoing tracing middleware traefik-0-core" routerName=websecure-traefik-0-core@docker middlewareName=tracing middlewareType=TracingForwarder entryPointName=websecure
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating middleware" middlewareType=Pipelining middlewareName=pipelining entryPointName=websecure routerName=whoami@docker serviceName=whoami-0-core
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating load-balancer" entryPointName=websecure routerName=whoami@docker serviceName=whoami-0-core
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating server 0 http://172.29.152.2:80" routerName=whoami@docker serviceName=whoami-0-core entryPointName=websecure serverName=0
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="child http://172.29.152.2:80 now UP"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Propagating new UP status"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Added outgoing tracing middleware whoami-0-core" middlewareName=tracing middlewareType=TracingForwarder entryPointName=websecure routerName=whoami@docker
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating middleware" entryPointName=websecure middlewareName=traefik-internal-recovery middlewareType=Recovery
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Adding route for zeus.lan with TLS options default" entryPointName=websecure
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Adding route for traefik-0-core with TLS options default" entryPointName=websecure
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="No entryPoint defined for this router, using the default one(s) instead: [web websecure]" routerName=traefik-0-core
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="No default certificate, generating one" tlsStoreName=default
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Try to challenge certificate for domain [traefik-0-core] found in HostSNI rule" routerName=websecure-traefik-0-core@docker rule="Host(`traefik-0-core`)" ACME CA="https://step-ca:9000/acme/acme/directory" providerName=myresolver.acme
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Try to challenge certificate for domain [zeus.lan] found in HostSNI rule" ACME CA="https://step-ca:9000/acme/acme/directory" routerName=whoami@docker rule="Host(`zeus.lan`)" providerName=myresolver.acme
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Looking for provided certificate(s) to validate [\"zeus.lan\"]..." providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory" routerName=whoami@docker rule="Host(`zeus.lan`)"
step-ca    | time="2022-08-06T11:01:56+02:00" level=info duration=21.235562ms duration-ns=21235562 fields.time="2022-08-06T11:01:56+02:00" method=POST name=ca nonce=U0NFN3B3QU05eFBZRFRCVFVsYlZRcWVDdmZQczdYRzk path=/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/SZqQiyS7nN4pKtm9nyzLLDwKDAQPEcTQ protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s13uc4k9ku9cg3b0 response="{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"0gk8cPJsyJQSyNdzfCWQnQPZk829pjzg\",\"url\":\"https://step-ca:9000/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/SZqQiyS7nN4pKtm9nyzLLDwKDAQPEcTQ\",\"error\":{\"type\":\"urn:ietf:params:acme:error:connection\",\"detail\":\"The server could not connect to validation target\"}}" size=318 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
step-ca    | time="2022-08-06T11:01:56+02:00" level=info duration=7.022616ms duration-ns=7022616 fields.time="2022-08-06T11:01:56+02:00" method=POST name=ca nonce=ZXVxQzBoR2xNRWxHNlpLSmtxaTltNXhiRGV0T2F3dko path=/acme/acme/authz/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s13uc4k9ku9cg3bg response="{\"identifier\":{\"type\":\"dns\",\"value\":\"traefik-0-core\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"0gk8cPJsyJQSyNdzfCWQnQPZk829pjzg\",\"url\":\"https://step-ca:9000/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/fntvaRYK8EFJXg0QhJgeTPZzd7HWA6Qg\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"0gk8cPJsyJQSyNdzfCWQnQPZk829pjzg\",\"url\":\"https://step-ca:9000/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/tOFr8JJUVIewjndyYorPaPusJnKX5pzD\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"0gk8cPJsyJQSyNdzfCWQnQPZk829pjzg\",\"url\":\"https://step-ca:9000/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/SZqQiyS7nN4pKtm9nyzLLDwKDAQPEcTQ\",\"error\":{\"type\":\"urn:ietf:params:acme:error:connection\",\"detail\":\"The server could not connect to validation target\"}}],\"wildcard\":false,\"expires\":\"2022-08-07T09:01:54Z\"}" size=848 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Adding certificate for domain(s) acme challenge temp,traefik-0-core"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Adding certificate for domain(s) acme challenge temp,zeus.lan"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="No ACME certificate generation required for domains [\"zeus.lan\"]." routerName=whoami@docker rule="Host(`zeus.lan`)" providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Looking for provided certificate(s) to validate [\"traefik-0-core\"]..." ACME CA="https://step-ca:9000/acme/acme/directory" providerName=myresolver.acme routerName=websecure-traefik-0-core@docker rule="Host(`traefik-0-core`)"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="No ACME certificate generation required for domains [\"traefik-0-core\"]." rule="Host(`traefik-0-core`)" ACME CA="https://step-ca:9000/acme/acme/directory" providerName=myresolver.acme routerName=websecure-traefik-0-core@docker
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Added outgoing tracing middleware noop@internal" routerName=web-to-websecure@internal middlewareName=tracing middlewareType=TracingForwarder entryPointName=web
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating middleware" middlewareType=RedirectScheme entryPointName=web routerName=web-to-websecure@internal middlewareName=redirect-web-to-websecure@internal
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Setting up redirection to https 443" entryPointName=web routerName=web-to-websecure@internal middlewareName=redirect-web-to-websecure@internal middlewareType=RedirectScheme
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Adding tracing to middleware" entryPointName=web routerName=web-to-websecure@internal middlewareName=redirect-web-to-websecure@internal
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating middleware" serviceName=traefik-0-core middlewareType=Pipelining middlewareName=pipelining entryPointName=web routerName=traefik-0-core@docker
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating load-balancer" serviceName=traefik-0-core entryPointName=web routerName=traefik-0-core@docker
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating server 0 http://172.29.152.4:80" routerName=traefik-0-core@docker serverName=0 serviceName=traefik-0-core entryPointName=web
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="child http://172.29.152.4:80 now UP"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Propagating new UP status"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Added outgoing tracing middleware traefik-0-core" entryPointName=web routerName=traefik-0-core@docker middlewareName=tracing middlewareType=TracingForwarder
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating middleware" entryPointName=web middlewareName=traefik-internal-recovery middlewareType=Recovery
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating middleware" serviceName=whoami-0-core middlewareName=pipelining middlewareType=Pipelining entryPointName=websecure routerName=whoami@docker
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating load-balancer" serviceName=whoami-0-core entryPointName=websecure routerName=whoami@docker
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating server 0 http://172.29.152.2:80" entryPointName=websecure routerName=whoami@docker serviceName=whoami-0-core serverName=0
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="child http://172.29.152.2:80 now UP"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Propagating new UP status"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Added outgoing tracing middleware whoami-0-core" entryPointName=websecure routerName=whoami@docker middlewareName=tracing middlewareType=TracingForwarder
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating middleware" serviceName=traefik-0-core middlewareName=pipelining middlewareType=Pipelining entryPointName=websecure routerName=websecure-traefik-0-core@docker
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating load-balancer" entryPointName=websecure routerName=websecure-traefik-0-core@docker serviceName=traefik-0-core
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating server 0 http://172.29.152.4:80" entryPointName=websecure routerName=websecure-traefik-0-core@docker serviceName=traefik-0-core serverName=0
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="child http://172.29.152.4:80 now UP"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Propagating new UP status"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Added outgoing tracing middleware traefik-0-core" middlewareType=TracingForwarder entryPointName=websecure routerName=websecure-traefik-0-core@docker middlewareName=tracing
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Creating middleware" entryPointName=websecure middlewareName=traefik-internal-recovery middlewareType=Recovery
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Adding route for traefik-0-core with TLS options default" entryPointName=websecure
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Adding route for zeus.lan with TLS options default" entryPointName=websecure
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Try to challenge certificate for domain [zeus.lan] found in HostSNI rule" ACME CA="https://step-ca:9000/acme/acme/directory" routerName=whoami@docker rule="Host(`zeus.lan`)" providerName=myresolver.acme
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Try to challenge certificate for domain [traefik-0-core] found in HostSNI rule" routerName=websecure-traefik-0-core@docker rule="Host(`traefik-0-core`)" providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Looking for provided certificate(s) to validate [\"traefik-0-core\"]..." providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory" routerName=websecure-traefik-0-core@docker rule="Host(`traefik-0-core`)"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="No ACME certificate generation required for domains [\"traefik-0-core\"]." ACME CA="https://step-ca:9000/acme/acme/directory" routerName=websecure-traefik-0-core@docker rule="Host(`traefik-0-core`)" providerName=myresolver.acme
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="Looking for provided certificate(s) to validate [\"zeus.lan\"]..." routerName=whoami@docker rule="Host(`zeus.lan`)" providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory"
traefik    | time="2022-08-06T11:01:56+02:00" level=debug msg="No ACME certificate generation required for domains [\"zeus.lan\"]." routerName=whoami@docker rule="Host(`zeus.lan`)" providerName=myresolver.acme ACME CA="https://step-ca:9000/acme/acme/directory"
step-ca    | time="2022-08-06T11:01:56+02:00" level=info duration=25.135911ms duration-ns=25135911 fields.time="2022-08-06T11:01:56+02:00" method=POST name=ca nonce=bUZESjhMWVdNZmlDV0JwSUtzSzV5NFVJTGhYam5XaDY path=/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/AGQAaWrkXgBajvG8R0RPUvWyp0JLwRPE protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s13uc4k9ku9cg3c0 response="{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/AGQAaWrkXgBajvG8R0RPUvWyp0JLwRPE\",\"error\":{\"type\":\"urn:ietf:params:acme:error:connection\",\"detail\":\"The server could not connect to validation target\"}}" size=318 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
step-ca    | time="2022-08-06T11:01:56+02:00" level=info duration=4.308401ms duration-ns=4308401 fields.time="2022-08-06T11:01:56+02:00" method=POST name=ca nonce=elBSVmFqSFIyb2ZzVVBVQVFtMW9TakVqM3g2Zm02bVk path=/acme/acme/authz/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5 protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s13uc4k9ku9cg3cg response="{\"identifier\":{\"type\":\"dns\",\"value\":\"zeus.lan\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/T3uxN0synYZoXUvdcudsJH8h5QkraLKc\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/ed29kNFuEEDevVLBkc3uImcXrksoMSje\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/AGQAaWrkXgBajvG8R0RPUvWyp0JLwRPE\",\"error\":{\"type\":\"urn:ietf:params:acme:error:connection\",\"detail\":\"The server could not connect to validation target\"}}],\"wildcard\":false,\"expires\":\"2022-08-07T09:01:54Z\"}" size=842 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
step-ca    | time="2022-08-06T11:02:02+02:00" level=info duration=7.310735ms duration-ns=7310735 fields.time="2022-08-06T11:02:02+02:00" method=POST name=ca nonce=TVY2VGZPcWhmNzVudUdNbVdUQWtMQ0NOR0M2TDdRcVc path=/acme/acme/authz/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s2juc4k9ku9cg3d0 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"traefik-0-core\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"0gk8cPJsyJQSyNdzfCWQnQPZk829pjzg\",\"url\":\"https://step-ca:9000/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/fntvaRYK8EFJXg0QhJgeTPZzd7HWA6Qg\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"0gk8cPJsyJQSyNdzfCWQnQPZk829pjzg\",\"url\":\"https://step-ca:9000/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/tOFr8JJUVIewjndyYorPaPusJnKX5pzD\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"0gk8cPJsyJQSyNdzfCWQnQPZk829pjzg\",\"url\":\"https://step-ca:9000/acme/acme/challenge/kHslwGWtweAeVYJlUmQn4vIFcoU9ZPSj/SZqQiyS7nN4pKtm9nyzLLDwKDAQPEcTQ\",\"error\":{\"type\":\"urn:ietf:params:acme:error:connection\",\"detail\":\"The server could not connect to validation target\"}}],\"wildcard\":false,\"expires\":\"2022-08-07T09:01:54Z\"}" size=848 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
step-ca    | time="2022-08-06T11:02:02+02:00" level=info duration=4.424573ms duration-ns=4424573 fields.time="2022-08-06T11:02:02+02:00" method=POST name=ca nonce=WFJYM2RCaVlnNzNuWEQyWVNCb0gwWWRldm1rekx4ZHU path=/acme/acme/authz/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5 protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s2juc4k9ku9cg3dg response="{\"identifier\":{\"type\":\"dns\",\"value\":\"zeus.lan\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/T3uxN0synYZoXUvdcudsJH8h5QkraLKc\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/ed29kNFuEEDevVLBkc3uImcXrksoMSje\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/AGQAaWrkXgBajvG8R0RPUvWyp0JLwRPE\",\"error\":{\"type\":\"urn:ietf:params:acme:error:connection\",\"detail\":\"The server could not connect to validation target\"}}],\"wildcard\":false,\"expires\":\"2022-08-07T09:01:54Z\"}" size=842 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=
step-ca    | time="2022-08-06T11:02:07+02:00" level=info duration=10.083198ms duration-ns=10083198 fields.time="2022-08-06T11:02:07+02:00" method=POST name=ca nonce=M0MwYkZxSUhISzFtMExxZTNuSHdHZnNPYXdFdmZlUlo path=/acme/acme/authz/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5 protocol=HTTP/1.1 referer= remote-address=172.29.152.4 request-id=cbn2s3ruc4k9ku9cg3e0 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"zeus.lan\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/T3uxN0synYZoXUvdcudsJH8h5QkraLKc\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/ed29kNFuEEDevVLBkc3uImcXrksoMSje\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"jme2JUAWqkHvtBaSKSBHztG6Di4dVK1Y\",\"url\":\"https://step-ca:9000/acme/acme/challenge/OADx7kwCVaoF8nL1rptmmw2mbVRsI2a5/AGQAaWrkXgBajvG8R0RPUvWyp0JLwRPE\",\"error\":{\"type\":\"urn:ietf:params:acme:error:connection\",\"detail\":\"The server could not connect to validation target\"}}],\"wildcard\":false,\"expires\":\"2022-08-07T09:01:54Z\"}" size=842 status=200 user-agent="containous-traefik/2.8.1 xenolf-acme/4.7.0 (release; linux; amd64)" user-id=

Answered by hslatman

Aug 9, 2022

The "The server could not connect to validation target" error is the result of the CA not being able to contact the system that requested a certificate for one or more DNS names or IPs.

In your case the requested domains are zeus.lan and traefik-0-core. In order to verify the requesting system, an ACME server will challenge the system by contacting it via HTTP, HTTPS or check a DNS record. For this to be successful, the ACME server must know where zeus.lan and traefik-0-core reside on the network and be able to route to it (if not challenged by DNS, which is probably true in this case). Things that can be in the way include DNS, firewalls or misconfigured IP routing.

I think the problem i…

View full answer

hslatman · 2022-08-09T21:52:24Z

hslatman
Aug 9, 2022
Collaborator

The "The server could not connect to validation target" error is the result of the CA not being able to contact the system that requested a certificate for one or more DNS names or IPs.

In your case the requested domains are zeus.lan and traefik-0-core. In order to verify the requesting system, an ACME server will challenge the system by contacting it via HTTP, HTTPS or check a DNS record. For this to be successful, the ACME server must know where zeus.lan and traefik-0-core reside on the network and be able to route to it (if not challenged by DNS, which is probably true in this case). Things that can be in the way include DNS, firewalls or misconfigured IP routing.

I think the problem is due to DNS not being resolved correctly. I think zeus.lan may be a machine outside your Docker network? I think it'll work if Docker can reach a local mDNS server on your LAN or by "repeating" the mDNS traffic from the LAN into the Docker network. The traefik-0-core could maybe be fixed with an alias in the Docker network. You should start troubleshooting by trying to ping or dig zeus.lan and traefik-0-core from inside the step-ca container.

Here's an example of someone else using step-ca and Traefik together: https://github.com/dogukancagatay/step-ca-example/blob/main/docker-compose.yml. It may contain some helpful pointers.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Error: "The server could not connect to validation target\". #1002

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 1 comment

{{title}}

Select a reply

Error: "The server could not connect to validation target\". #1002

cgHome Aug 6, 2022

Replies: 1 comment

hslatman Aug 9, 2022 Collaborator

cgHome
Aug 6, 2022

hslatman
Aug 9, 2022
Collaborator