Let's encrypt sans handling

[aacebedo]

Hi

I am using traefik on a rpi with one domain and multiple sans.
Instead of having one certificate request with the domain and sans I have one request per sans leading to exceed the certificate request limit.

[emilevauge]

@aacebedo Hi
If you are using OnDemand, this is the normal behavior. OnDemand will generate a cert using the request domain, which doesn't contain any SAN.
For now, SANs can only be obtained at config time, not at run time.

[aacebedo]

Thank you for the answer!
I am using the ondemand mode so I am going to switch it to false.
However I also tried without the flag and saw as many certificatse as I have SANs in the acme.json.
Each of these had the main domain set to one SAN.

I didn't checked the content of the certificates themselves with openssl yet, I'll check it tonight.
I had to switch to the staging server (my limit is now reached I have to wait 1 week)

[emilevauge]

Could you give us your toml config file?

[aacebedo]

You can find the template here.
https://github.com/aacebedo/docker-boxes/blob/master/utilities/traefik/files/traefik.conf.tmpl

Just replace the sans and main with your own

[h-bragg]

I have a similar issue.

I have a lot of sub domains being used and would like more to be added with little fuss.

To prevent some rate limiting, I can pre-generate a certificate with a set of SAN domains that cover most things, it would be good to use this certificate for domains, and keep the ability to generate new domains for anything not encountered.

Could specify the certificate you want to use via config, or if the domain being used with (onHostRule) exists in an existing domain SANs then use that...

Looking at the code it looks like onDemand should use the SANS, however it has been deprecated (https://github.com/containous/traefik/blob/master/acme/acme.go#L573)

[andig]

I do actually have the reverse problem but it fits the issue title.

I'm serving multiple domains from a single machine using DNS CNAMEs. Traefik/LE have setup SAN certificates for totally unrelated domain names (not subdomains).

While this works fine I'd like those to be separate domains to avoid a user clicking on certificate a for domain a and be presented with certificate b that also covers domain a.

[traefiker]

Closed by #2913.