Traefik | ForwardAuth | no certificate issued

[Maximilian-Pfau-P]

First of all I would like to thank you for this project, it has helped us a lot in our security efforts. I'm using this container with the Google OAuth client which is working fine so far.

We think, that the problem is that Traefik doesn't create certificates when the OAuth container is added to the IngressRoute as middleware.
But for example the redirect URL after a successul login never get a certificate, even if we deploy it without the middleware. As CA we use Lets Encrypt with the DNS Challenge. As DNS we created a wildcard dns name for traefik, which is working fine for all the applications.

Since with a missing certificate of the authentication ingress route it cannot be used productively, I would be very grateful if someone could help me with this problem.

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: traefik-forward-auth
  namespace: traefik
  labels:
    app: traefik
spec:
  entryPoints:
    - https
  routes:
  - match: Host(`auth.*)
    kind: Rule
    services:
    - name: traefik-forward-auth
      port: 4181
    middlewares:
    - name: traefik-forward-auth
      namespace: traefik
  tls:
    certresolver: letsencrypt

[psarossy]

I'm having this exact same issue, @maxger did you ever find a solution?

I wanted to enable strict SSL on cloudflare, and everything kept working until I had to authenticate again, when I learnt that my auth.mydomain.com type address is serving a self signed cert from traefik instead of the letsencrypt one like every other defined domain.

[Maximilian-Pfau-P]

@psarossy no sorry, we didn't found a viable solution

@thomseddon is there a configuration error on our side?

[thomseddon]

The issue seems to be traefik not generating the certificate, I'm converting this to a discussion as I don't believe there is an underlying issue with traefik-forward-auth here.

In terms of resolving the issue, can you enable debug logging on traefik and start to unpick if your auth host is being included in the letsencrypt generation?
Do you have other ingressroute's that are working correctly with a wildcard host?