#recreationalcomputertouching #homelab #selfhosted
I have just spent a few hours trying to understand why my DNS validated LE certs were not renewing.
I use Traefik v3.6 in Docker and auto LE handling. it's neat.
Turns out that the underlying ACME client (LEGO) that Traefik uses to handle DNS records for the DNS validation method has changed its behaviour.
The outcome of the change is that Traefik/ACME/LEGO will happily create the certificate but will fail the renewal because of DNS shenanigans.
If you tell the LEGO client `LEGO_DISABLE_CNAME_SUPPORT=true` via an ENV VAR previous certificate renewal behaviours return.
Hopefully this helps someone else understand the core issue.
That work also resulted in a somewhat hefty refactor of my Traefik config to make things clearer and neater.