1. The problem I’m having:
I am facing an issue where Caddy tries to request a certificate for a domain, even though I am explicitly directing it to use the certificate I’ve provided (by specifying the directory path). I want to prevent the unnecessary request for the domain while allowing another domain within the Caddyfile to have a Let’s Encrypt certificate.
It’s not a critical error, as the domains function properly, but it’s an error in the log that shouldn’t appear.
Note: The domain names are real. I am using the machine’s hostname as a domain to internally consume the information of node exporter. I have not modified my log file or caddyfile for this post, but they come from a test server.
Another point to clarify: The reason for auto_https ignore_loaded_certs is that without setting it this way, Caddy uses the self-signed certificate for the domain helloworld.0xanto.dev (which indeed needs a Let’s Encrypt domain).
2. Error messages and/or full log output:
caddy | {"level":"error","ts":1691503068.6744905,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"caddy-test","issuer":"acme.zerossl.com-v2-DV90","error":"HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid DNS identifier [caddy-test]"}
caddy | {"level":"error","ts":1691503068.6754205,"logger":"tls.obtain","msg":"will retry","error":"[caddy-test] Obtain: [caddy-test] creating new order: attempt 1: https://acme.zerossl.com/v2/DV90/newOrder: HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid DNS identifier [caddy-test] (ca=https://acme.zerossl.com/v2/DV90)","attempt":5,"retrying_in":600,"elapsed":611.188483961,"max_duration":2592000}
caddy | {"level":"info","ts":1691503668.6767552,"logger":"tls.obtain","msg":"obtaining certificate","identifier":"caddy-test"}
caddy | {"level":"error","ts":1691503669.27204,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"caddy-test","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Error creating new order :: Cannot issue for \"caddy-test\": Domain name needs at least one dot"}
3. Caddy version:
caddy 2.6.4
4. How I installed and ran Caddy:
a. System environment:
- OS: Ubuntu 22.04.2 LTS
- Using Docker 24.0.5
b. Command:
docker compose up -d
c. Service/unit/compose file:
version: '3.3'
services:
caddy:
image: caddy:2.6.4@sha256:5acae6b87b26a591d6d14ec2704b7f2cd94b888ad62af16a02356d3124198ede
restart: always
container_name: caddy
volumes:
- ./caddy/Caddyfile:/etc/caddy/Caddyfile
- ./caddy/site:/srv
- ./caddy/caddy_data:/data
- ./caddy/caddy_config:/config
- /etc/ssl/certs/selfsigned_certificate.pem:/etc/ssl/certs/selfsigned_certificate.pem
- /etc/ssl/private/selfsigned_certificate.pem:/etc/ssl/private/selfsigned_certificate.pem
network_mode: host
d. My complete Caddy config:
{
auto_https ignore_loaded_certs
}
# Node Exporter
CADDY-TEST:8000 {
reverse_proxy 127.0.0.1:9100
tls /etc/ssl/certs/selfsigned_certificate.pem /etc/ssl/private/selfsigned_certificate.pem
}
# Public helloworld website
helloworld.0xanto.dev {
respond "Hello, world!"
}
