TLS certificate not obtained for remaining names

[DavidePrincipi]

Removing a name from the TLS certificates page is not possible. The validation request hits a timeout error.

Steps to reproduce

In TLS certificates page

• Add name uno1.nicolatest.it
• Add name rl1.nicolatest.it
• Add name due1.nicolatest.it
• Remove name uno1.nicolatest.it

Expected behavior

A new certificate request for the remaining names rl1.nicolatest.it and due1.nicolatest.it is issued to Let's Encrypt.

Actual behavior

Traefik doesn't issue a new certificate request and after 30 seconds the validation procedure times out:

Aug 08 12:27:56 rl1 agent@traefik1[31724]: Timeout after about 30 seconds. Certificate not obtained for ['rl1.nicolatest.it', 'due1.nicolatest.it'].

Components

• Traefik 3.2.1

See also

• Discussion https://mattermost.nethesis.it/nethesis/pl/jjf9ses14fnstnpuiwp4f5y3ne

---

Thanks to @nrauso

[DavidePrincipi]

The validation procedure generates a temporary route configuration file to trigger a Traefik certificate request. However, in this case, the request includes a set of names already covered by a certificate in acme.json, so Traefik does not issue a new request, and the validation times out.

Interestingly, if the _default_cert.yml file is edited with vi and one of the names is removed, Traefik issues a new certificate request. While the request is pending, the default Traefik certificate is an internal one. Thus there's a different Traefik behavior between default certificate configuration and router configuration.

[DavidePrincipi]

In Testing

See parent issue #7544 (comment)