On version 1.18.1 cert status issue

[andrey0001]

When I upgraded to the 1.18.1, I see that some of my certificates "failed"
acme_json_path: "config/letsencrypt/acme.json" use only "acme.json" to check certificates.
But I have additional config in traefik for wildcard certificates:

certificatesResolvers:
  letsencrypt:
    acme:
      httpChallenge:
        entryPoint: web
      email: "some@email.com"
      storage: "/letsencrypt/acme.json"
      caServer: "https://acme-v02.api.letsencrypt.org/directory"
  do-le:
    acme:
      dnschallenge:
        provider: "digitalocean"
        resolvers: "1.1.1.1:53"
      email: "ome@email.com"
      storage: "/letsencrypt/acme-digitalocean.json"
      caServer: "https://acme-v02.api.letsencrypt.org/directory"
  cf-le:
    acme:
      dnschallenge:
        provider: "cloudflare"
        resolvers: "1.1.1.1:53"
      email: "ome@email.com"
      storage: "/letsencrypt/acme-cf.json"
      caServer: "https://acme-v02.api.letsencrypt.org/directory"

In this case, all my certificates located outside of "acme.json" is "failed".

I think I'm not the only one with wildcard certificates configured, and the problem is still ongoing.
What can I do?

[oschwartz10612]

Ahh so you store the certs in different files. We dont handle that right now but I will try to for the next 1.18.2 patch. Will they all conflict if you point them at the same file?

[oschwartz10612]

Thats what I did in the patch - probbaby releasing tomorrow

[andrey0001]

I checked with 1.18.2, added:

acme:
  acme_json_path: "config/letsencrypt/"

But nothing changed, and in log I see:

2026-05-04T09:04:20+00:00 [warn]: Certificate not found for domain: 8b93qar4rmdd3tq

2026-05-04T09:04:20+00:00 [warn]: Certificate not found for domain: 8b93qar4rmdd3tq

2026-05-04T09:04:20+00:00 [warn]: Certificate not found for domain: 8b93qar4rmdd3tq

2026-05-04T09:04:20+00:00 [warn]: Certificate not found for domain: 8b93qar4rmdd3tq

[LaurenceJJones]

Just note the letsencrpt folder scans for acme.json files only, so if you are splitting into folders then each will be named acme.json

Example

config/letsencrypt/dns/acme.json
config/letsencrypt/http/acme.json

and so on, if you changed the name to acme-somethingelse.json then this will not find it.

[andrey0001]

Nothing clear, I separated by folders, but now I see in log:
2026-05-04T10:40:08+00:00 [warn]: acmeCertSync: cannot stat path "config/letsencrypt/acme.json": Error: ENOENT: no such file or directory, stat 'config/letsencrypt/acme.json'

[AstralDestiny]

You have to have them all be "acme.json" or just merge all the .json files to point to the same location right now.

[andrey0001]

For now I have:

certificatesResolvers:
  letsencrypt:
    acme:
      httpChallenge:
        entryPoint: web
      email: "test@test.com"
      storage: "/letsencrypt/http/acme.json"
      caServer: "https://acme-v02.api.letsencrypt.org/directory"
  do-le:
    acme:
      dnschallenge:
        provider: "digitalocean"
        resolvers: "1.1.1.1:53"
      email: "test@test.com"
      storage: "/letsencrypt/do/acme.json"
      caServer: "https://acme-v02.api.letsencrypt.org/directory"
  cf-le:
    acme:
      dnschallenge:
        provider: "cloudflare"
        resolvers: "1.1.1.1:53"
      email: "test@test.com"
      storage: "/letsencrypt/cf/acme.json"
      caServer: "https://acme-v02.api.letsencrypt.org/directory"

And in config I have:

acme:
  acme_json_path: "config/letsencrypt/"

Am I correct in understanding that it should go through the subfolders and find all acme.json?

[Sebuschka]

I did so, now it does not show as pending but as failed.

In private resources on *.sebuschka.de its now ok. but for *.remote.sebuschka.de its also failed.

Is there a way to check what certs were imported / found?

[LaurenceJJones]

I see the issue in the code, we only accept sans if they are a direct wildcard of the main domain.

EG: *.sebuschka.de matches your base sebuschka.de, but it doesnt match *.remote.sebuschka.de.

coderef:

pangolin/server/private/lib/acmeCertSync.ts

Lines 267 to 274 in 6a7d4fd

	if (Array.isArray(sans)) {
	for (const san of sans) {
	if (typeof san !== "string") continue;
	if (san === `*.${main}` || san.startsWith("*.")) {
	return { wildcard: true, wildcardSan: san };
	}
	}
	}

[Sebuschka]

Will / can it be added so i gets all certs incl. all sans ?

[LaurenceJJones]

Will / can it be added so i gets all certs incl. all sans ?

Yep we are going to work on it, can't promise it in next but release after definately

[oschwartz10612]

Going to try to fix in the next release a3ce382