<p>I'm trying to set up LetsEncrypt with a wildcard domain on my Traefik instance. Traefik has been installed from the Helm Chart <code>stable/traefik</code>.</p>

<p>We're using Google Cloud for DNS so I want to use <code>gcloud</code> as my Traefik acme provider.</p>

<p>As mentioned, it's a wildcard. I'm trying to have Traefik manage LetsEncrypt for <code>*.domain.com</code> with <code>domain.com</code> as a SAN.</p>

<p>I'm currently using a K8s claim for storing the <code>acme.json</code> file and it's been populated with a private key but no certificates.</p>

<p><strong>Traefik Helm values</strong></p>

<pre><code># LetsEncrypt
acme:
  acmeLogging: true
  challengeType: 'dns-01'
  enabled: true
  domains:
    enabled: true
    main: '*.&lt;domain&gt;'
    sans:
        - &lt;domain&gt;
  defaultEntryPoints:
  - http
  - https
  dnsProvider:
    name: 'gcloud'
    gcloud:
      GCE_PROJECT: &lt;redacted&gt;
      GCE_SERVICE_ACCOUNT_FILE: /secrets/gcloud-credentials.json
  email: &lt;redacted&gt;
  entryPoint: 'https'
  entryPoints:
    http:
      address: ':80'
    https:
      address: ':443'
  persistence:
    enabled: true
    existingClaim: 'certificate-store'
  provider: 'gcloud'
  staging: true

# SSL configuration
ssl:
 enabled: true
 enforced: true
</code></pre>

<p><strong>acme.json</strong></p>

<pre><code>{
  "Account": {
    "Email": "&lt;redacted&gt;",
    "Registration": {
      "body": {
        "status": "valid",
        "contact": [
          "mailto:&lt;redacted&gt;"
        ]
      },
      "uri": "https://acme-staging-v02.api.letsencrypt.org/acme/acct/9091953"
    },
    "PrivateKey": "&lt;redacted&gt;",
    "KeyType": "4096"
  },
  "Certificates": null,
  "HTTPChallenges": {},
  "TLSChallenges": {}
}
</code></pre>

<p>All responses from Traefik should be being served with a wildcard LetsEncrypt cert for said domain that should auto-renew.</p>

<p>What additional steps might I need to carry out to have Traefik start generating the certificates, and how can I configure Traefik to use this certificate by default? (Rather than the built-in one)</p>

<p>Thank you</p>

Meegles
<p>I figured this one out.
I set the following (in addition or replacement of the above) in my Helm chart overrides YAML.</p>

<pre><code>acme:
  caServer: 'https://acme-v02.api.letsencrypt.org/directory'
  domains:
    enabled: true
    domainsList:
      - main: '*.&lt;domain&gt;'
      - sans:
          - &lt;domain&gt;
</code></pre>

<p>I also got rid of <code>persistence.existingClaim</code> and let Traefik make its own claim, but if you already have an existing one keeping this definition shouldn't cause you any issues!</p>

<p>All Traefik ingresses are now serving the correct LetsEncrypt certificate without any additional configuration.</p>

<p>Thank you Vasily Angapov for your response - you were correct in terms of the <code>acme.domains.domainsList</code> section. :-)</p>
