Single cert for wildcard and root domains

[stash]

1. The problem I’m having:

From the Cloudflare dashboard, it appears that Caddy is trying to obtain 2 certificates, creating 2 TXT records: for *.example.com and example.com. I know that it is possible to generate a single certificate for wildcard and root domains, but I’m not sure if caddy supports this and if my Caddyfile is even correct, given that I’m getting resolving: waiting for resolver certmagic.solverWrapper to be ready: timed out waiting for full record propagation. But caddy still obtained the certificate for the root domain, the wildcard domains are still unavailable

2. Error messages and/or full log output:

3. Caddy version:

$ caddy version
v2.9.0 h1:xxx

4. How I installed and ran Caddy:

a. System environment:

b. Command:

c. Service/unit/compose file:

d. My complete Caddy config:

*.example.com, example.com {
    tls {
        dns cloudflare TOKEN
    }

    @root host example.com
    reverse_proxy @root http://172.24.0.2:7575

    @subdomain1 host subdomain1.example.com
    reverse_proxy @subdomain1 http://172.20.0.2:80

    @subdomain2 host subdomain2.example.com
    reverse_proxy @subdomain2 http://172.23.0.2:2283
}

5. Links to relevant resources:

[Bruce5051 (Bruce)]

@stash

it appears that Caddy is trying to obtain 2 certificates, creating 2 TXT records: for *.example.com and example.com

Hi @stash,

It maybe just one certificate. Typically a wildcard certificate has 2 names example.com and *.example.com that might each have their own TXT record _acme-challenge.example.com.

[Mohammed90 (Mohammed Al Sahaf)]

Caddy doesn’t do multi-SAN certificates. All of Caddy certificates are single SAN.

It seems Caddy doesn’t see the record after setting it. Caddy checks for the presence of the TXT record for the DNS challenge before asking the CA to check it. Typically Caddy checks DNS for the TXT record immediately after setting it, and the default timeout is 2 minutes. You can configure that behavior using propagation_timeout and propagation_delay. You can also set propagation_delay to -1 to tell Caddy not to check for propagation.

@stash

I’m getting resolving: waiting for resolver certmagic.solverWrapper to be ready: timed out waiting for full record propagation.

tls (Caddyfile directive) - Caddy Documentation

The DNS challenge is mandatory for wildcard certificates. For non-wildcard, there are other challenges that don’t require Caddy to manipulate DNS, i.e. HTTP and ALPN challenges. That’s why the cert for the root domain is available but the wildcard cert failed.

@stash

But caddy still obtained the certificate for the root domain, the wildcard domains are still unavailable

[stash]

Thanks, I added propagation delay 30s to the tls section, now all domains work.