How to get a certificate for a specific subdomain when using a wildcard domain

1. The problem I’m having:

I try to get a certificate for a specific subdomain while also using a wildcard certificate.

I have a wildcard domain, lets say *.example.com
I can get a wildcard certificate for this, works perfectly with Caddy.

Now i have a subdomain sub.example.com and i want Caddy to not use the wildcard certificate but to get a certificate for sub.example.com

The relevant part of my Caddyfile looks like this:

sub.example.com {
    tls {
		issuer acme
	}

    reverse_proxy 1.2.3.4
}

*.example.com {
    reverse_proxy 1.2.3.4.5
    tls {
        dns ionos ...
    }
}

The Caddy Documentation says i have to explicitly configure to get a certificate for my subdomain:

Blockquote
As of Caddy 2.10, when automating a wildcard certificate, Caddy will use the wildcard certificate for individual subdomains in the configuration. It will not get certificates for individual subdomains unless explicitly configured to do so.

I just can’t find any documentation on how to do this. And my configuration does not work, if i open sub.example.com in the browser i can see that the certificate is for *.example.com

Would be great if someone could tell me how to do this the right way.

2. Error messages and/or full log output:

No error messages.

3. Caddy version:

2.10.2

4. How I installed and ran Caddy:

a. System environment:

Docker

Use tls force_automate for your sub.example.com

4 Likes

Yeah sorry about this one, we haven’t finished documenting this feature yet. Coming soon. But yes, tls force_automate { will do it.

3 Likes

Thank you very much, tls force_automate works.